Big-iq (F5) - vulnerabilities (CVEs)

23 CVEs, 0 in the last 30 days, 20 known versions, newest CVE from 2026-09-02. Vendor: F5.

CVEs of Big-iq

CVE-2026-66842 - CVSS 8.8 (high), 2026-09-02: BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to…
CVE-2026-42937 - CVSS 7.1 (high), 2026-05-13: Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These…
CVE-2026-42406 - CVSS 8.7 (high), 2026-05-13: A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify…
CVE-2026-41959 - CVSS 7.1 (high), 2026-05-13: Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These…
CVE-2026-41957 - CVSS 8.8 (high), 2026-05-13: An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility. Note: Software…
CVE-2026-41954 - CVSS 6.9 (medium), 2026-05-13: Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated…
CVE-2026-41219 - CVSS 7.1 (high), 2026-05-13: An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView…
CVE-2026-40698 - CVSS 8.7 (high), 2026-05-13: A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create…
CVE-2026-32643 - CVSS 8.7 (high), 2026-05-13: A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify…
CVE-2026-20916 - CVSS 8.1 (high), 2026-05-13: An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ…
CVE-2024-47139 - CVSS 6.8 (medium), 2024-10-16: A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility that allows an attacker with the…
CVE-2024-21782 - CVSS 6.7 (medium), 2024-02-14: BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell…
CVE-2023-41964 - CVSS 6.5 (medium), 2023-10-10: The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables. Note: Software versions which have reached End of…
CVE-2023-43485 - CVSS 5.5 (medium), 2023-10-10: When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which…
CVE-2023-38419 - CVSS 4.3 (medium), 2023-08-02: An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests. Note: Software…
CVE-2023-29240 - CVSS 5.4 (medium), 2023-05-03: An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint. Note: Software…
CVE-2022-41770 - CVSS 6.5 (medium), 2022-10-19: In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ all…
CVE-2022-41694 - CVSS 4.9 (medium), 2022-10-19: In BIG-IP versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, and BIG-IQ versions 8.x before 8.2.0.1 and…
CVE-2019-19151 - CVSS 5.5 (medium), 2019-12-23: On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0,…
CVE-2019-6688 - CVSS 4.3 (medium), 2019-12-23: On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5 and BIG-IQ versions 6.0.0-6.1.0 and…
CVE-2019-6665 - CVSS 9.4 (critical), 2019-11-27: On BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1,…
CVE-2019-6620 - CVSS 7.2 (high), 2019-07-02: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4 and BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, an undisclosed…
CVE-2019-6642 - CVSS 8.8 (high), 2019-07-01: In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise…
CVE-2014-3220 - CVSS 9 (critical), 2014-05-05: F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a…