Big-ip Policy Enforcement Manager (F5) - vulnerabilities (CVEs)

533 CVEs, 0 in the last 30 days, 278 known versions, newest CVE from 2026-09-02. Vendor: F5.

CVEs of Big-ip Policy Enforcement Manager

• CVE-2026-63020 - CVSS 3.1 (low), 2026-09-02: A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages  Impact: An attacker may trick…
• CVE-2026-42937 - CVSS 7.1 (high), 2026-05-13: Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These…
• CVE-2026-42924 - CVSS 8.7 (high), 2026-05-13: An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in…
• CVE-2026-42920 - CVSS 8.7 (high), 2026-05-13: When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management…
• CVE-2026-42919 - CVSS 7.1 (high), 2026-05-13: A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful…
• CVE-2026-42930 - CVSS 8.7 (high), 2026-05-13: When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP…
• CVE-2026-42781 - CVSS 7.1 (high), 2026-05-13: When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic…
• CVE-2026-42406 - CVSS 8.7 (high), 2026-05-13: A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify…
• CVE-2026-42409 - CVSS 8.7 (high), 2026-05-13: When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause…
• CVE-2026-42408 - CVSS 6.7 (medium), 2026-05-13: When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker…
• CVE-2026-41959 - CVSS 7.1 (high), 2026-05-13: Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These…
• CVE-2026-42063 - CVSS 6.9 (medium), 2026-05-13: A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive…
• CVE-2026-42058 - CVSS 5.3 (medium), 2026-05-13: An authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an information leak of BIG-IP local user account names.  Note: Software…
• CVE-2026-41953 - CVSS 8.7 (high), 2026-05-13: A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify…
• CVE-2026-41957 - CVSS 8.8 (high), 2026-05-13: An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility.  Note: Software…
• CVE-2026-41956 - CVSS 8.7 (high), 2026-05-13: When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to…
• CVE-2026-41954 - CVSS 6.9 (medium), 2026-05-13: Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated…
• CVE-2026-41218 - CVSS 8.7 (high), 2026-05-13: When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery…
• CVE-2026-41217 - CVSS 8.3 (high), 2026-05-13: A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or…
• CVE-2026-41225 - CVSS 9.1 (critical), 2026-05-13: A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that…
• CVE-2026-40703 - CVSS 5.4 (medium), 2026-05-13: A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility.  Note: Software versions which have reached End…
• CVE-2026-41219 - CVSS 7.1 (high), 2026-05-13: An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView…
• CVE-2026-40629 - CVSS 8.7 (high), 2026-05-13: When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.  Note:…
• CVE-2026-40699 - CVSS 7.1 (high), 2026-05-13: A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed…
• CVE-2026-40618 - CVSS 8.7 (high), 2026-05-13: When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware…
• CVE-2026-40698 - CVSS 8.7 (high), 2026-05-13: A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create…
• CVE-2026-40631 - CVSS 8.7 (high), 2026-05-13: An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege…
• CVE-2026-40435 - CVSS 6.9 (medium), 2026-05-13: When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses.  Note: Software…
• CVE-2026-40423 - CVSS 8.7 (high), 2026-05-13: When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software…
• CVE-2026-40462 - CVSS 7.1 (high), 2026-05-13: Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to…
• CVE-2026-39455 - CVSS 8.7 (high), 2026-05-13: When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the…
• CVE-2026-39459 - CVSS 8.6 (high), 2026-05-13: A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create…
• CVE-2026-39458 - CVSS 8.7 (high), 2026-05-13: When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic…
• CVE-2026-35062 - CVSS 7.1 (high), 2026-05-13: An authenticated iControl SOAP user may be able to obtain information of other accounts.  Note: Software versions which have reached End of Technical Support…
• CVE-2026-34019 - CVSS 6.3 (medium), 2026-05-13: When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management…
• CVE-2026-32673 - CVSS 8.7 (high), 2026-05-13: A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute…
• CVE-2026-32643 - CVSS 8.7 (high), 2026-05-13: A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify…
• CVE-2026-34176 - CVSS 8.7 (high), 2026-05-13: When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit…
• CVE-2026-24464 - CVSS 6.9 (medium), 2026-05-13: When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker…
• CVE-2026-20732 - CVSS 4.3 (medium), 2026-02-04: A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages.  Note: Software versions which…
• CVE-2025-58071 - CVSS 8.7 (high), 2025-10-15: When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions…
• CVE-2025-61990 - CVSS 8.7 (high), 2025-10-15: When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note:…
• CVE-2025-61958 - CVSS 8.7 (high), 2025-10-15: A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions…
• CVE-2025-61951 - CVSS 8.7 (high), 2025-10-15: Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  This issue may occur when a Datagram Transport Layer Security (DTLS) 1.2…
• CVE-2025-59781 - CVSS 8.7 (high), 2025-10-15: When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilization.  …
• CVE-2025-59483 - CVSS 8.5 (high), 2025-10-15: A validation vulnerability exists in an undisclosed URL in the Configuration utility.  Note: Software versions which have reached End of Technical Support…
• CVE-2025-59481 - CVSS 8.7 (high), 2025-10-15: A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource…
• CVE-2025-59268 - CVSS 6.9 (medium), 2025-10-15: On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthenticated remote attacker through the…
• CVE-2025-59269 - CVSS 8.4 (high), 2025-10-15: A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript…
• CVE-2025-58096 - CVSS 8.2 (high), 2025-10-15: When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undisclosed traffic can cause the Traffic…
• CVE-2025-58424 - CVSS 6.3 (medium), 2025-10-15: On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which do not have message integrity…
• CVE-2025-58153 - CVSS 8.2 (high), 2025-10-15: Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed Bridge (HSB) may experience a…
• CVE-2025-54755 - CVSS 6.9 (medium), 2025-10-15: A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files which are not limited to the…
• CVE-2025-54479 - CVSS 8.7 (high), 2025-10-15: When a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, undisclosed requests can cause the Traffic Management…
• CVE-2025-48008 - CVSS 8.7 (high), 2025-10-15: When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's…
• CVE-2025-53868 - CVSS 8.7 (high), 2025-10-15: When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode restrictions using…
• CVE-2025-53856 - CVSS 8.7 (high), 2025-10-15: When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity…
• CVE-2025-53474 - CVSS 8.7 (high), 2025-10-15: When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to…
• CVE-2025-46706 - CVSS 8.7 (high), 2025-10-15: When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an increase in memory resource…
• CVE-2025-54500 - CVSS 6.9 (medium), 2025-08-13: An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit…
• CVE-2025-52585 - CVSS 8.7 (high), 2025-08-13: When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diffie-Hellman (ADH) ciphers enabled,…
• CVE-2025-41399 - CVSS 8.7 (high), 2025-05-07: When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource…
• CVE-2025-41433 - CVSS 8.7 (high), 2025-05-07: When a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured on a Message Routing virtual…
• CVE-2025-36557 - CVSS 8.7 (high), 2025-05-07: When an HTTP profile with the Enforce RFC Compliance option is configured on a virtual server, undisclosed requests can cause the Traffic Management…
• CVE-2025-41431 - CVSS 8.7 (high), 2025-05-07: When connection mirroring is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate in the…
• CVE-2025-41414 - CVSS 8.7 (high), 2025-05-07: When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate.  Note: Software versions which have…
• CVE-2025-35995 - CVSS 8.7 (high), 2025-05-07: When a BIG-IP PEM system is licensed with URL categorization, and the URL categorization policy or an iRule with the urlcat command is enabled on a virtual…
• CVE-2025-36504 - CVSS 8.7 (high), 2025-05-07: When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization.  Note:…
• CVE-2025-31644 - CVSS 8.7 (high), 2025-05-07: When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow…
• CVE-2025-24497 - CVSS 8.7 (high), 2025-02-05: When URL categorization is configured on a virtual server, undisclosed requests can cause TMM to terminate.  Note: Software versions which have reached End of…
• CVE-2025-24320 - CVSS 8 (high), 2025-02-05: A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript…
• CVE-2025-22846 - CVSS 8.7 (high), 2025-02-05: When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management…
• CVE-2025-23239 - CVSS 8.7 (high), 2025-02-05: When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed…
• CVE-2025-22891 - CVSS 8.7 (high), 2025-02-05: When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop…
• CVE-2025-21091 - CVSS 8.7 (high), 2025-02-05: When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have…
• CVE-2025-21087 - CVSS 8.9 (high), 2025-02-05: When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in…
• CVE-2025-20058 - CVSS 8.9 (high), 2025-02-05: When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note:…
• CVE-2025-20045 - CVSS 8.7 (high), 2025-02-05: When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type…
• CVE-2025-20029 - CVSS 8.8 (high), 2025-02-05: Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute…
• CVE-2024-45844 - CVSS 8.6 (high), 2024-10-16: BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings.  Note: Software versions…
• CVE-2024-41727 - CVSS 8.7 (high), 2024-08-14: In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an…
• CVE-2024-41723 - CVSS 5.3 (medium), 2024-08-14: Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names.  Note: Software versions which have reached End of Technical…
• CVE-2024-41164 - CVSS 8.2 (high), 2024-08-14: When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control…
• CVE-2024-39778 - CVSS 8.7 (high), 2024-08-14: When a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge (HSB), undisclosed requests can cause TMM to terminate.   Note:…
• CVE-2024-32761 - CVSS 6.5 (medium), 2024-05-08: Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This…
• CVE-2024-33608 - CVSS 7.5 (high), 2024-05-08: When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions…
• CVE-2024-33604 - CVSS 6.1 (medium), 2024-05-08: A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript…
• CVE-2024-31156 - CVSS 8 (high), 2024-05-08: A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript…
• CVE-2024-28889 - CVSS 5.9 (medium), 2024-05-08: When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the…
• CVE-2024-27202 - CVSS 4.7 (medium), 2024-05-08: A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run…
• CVE-2024-25560 - CVSS 7.5 (high), 2024-05-08: When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions…
• CVE-2024-23982 - CVSS 7.5 (high), 2024-02-14: When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to…
• CVE-2024-23979 - CVSS 7.5 (high), 2024-02-14: When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured on a virtual server,…
• CVE-2024-23976 - CVSS 6 (medium), 2024-02-14: When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX…
• CVE-2024-24775 - CVSS 7.5 (high), 2024-02-14: When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to…
• CVE-2024-23314 - CVSS 7.5 (high), 2024-02-14: When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel (TMM) to terminate.  Note:…
• CVE-2024-22389 - CVSS 7.2 (high), 2024-02-14: When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software…
• CVE-2024-22093 - CVSS 8.7 (high), 2024-02-14: When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed…
• CVE-2024-21782 - CVSS 6.7 (medium), 2024-02-14: BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell…
• CVE-2023-46748 - CVSS 8.8 (high), 2023-10-26: An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the…