Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-42919 (GCVE-0-2026-42919)
Vulnerability from cvelistv5 – Published: 2026-05-13 14:12 – Updated: 2026-05-14 03:56
VLAI
EPSS
Title
F5 BIG-IP Appliance Mode Vulnerability
Summary
A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://my.f5.com/manage/s/article/K000158971 | vendor-advisorypatch |
Impacted products
Date Public
2026-05-13 14:00
Credits
F5
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42919",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T03:56:24.244Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"modules": [
"All Modules"
],
"product": "BIG-IP",
"vendor": "F5",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "21.1.0",
"versionType": "custom"
},
{
"lessThan": "21.0.0.1",
"status": "affected",
"version": "21.0.0",
"versionType": "custom"
},
{
"lessThan": "17.5.1.4",
"status": "affected",
"version": "17.5.0",
"versionType": "custom"
},
{
"lessThan": "17.1.3.1",
"status": "affected",
"version": "17.1.0",
"versionType": "custom"
},
{
"lessThan": "*",
"status": "affected",
"version": "16.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "F5"
}
],
"datePublic": "2026-05-13T14:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.\u003c/span\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003eNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
}
],
"value": "A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.\n\n\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T14:12:32.468Z",
"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
"shortName": "f5"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://my.f5.com/manage/s/article/K000158971"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "F5 BIG-IP Appliance Mode Vulnerability",
"x_generator": {
"engine": "F5 SIRTBot v1.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
"assignerShortName": "f5",
"cveId": "CVE-2026-42919",
"datePublished": "2026-05-13T14:12:32.468Z",
"dateReserved": "2026-04-30T23:02:47.674Z",
"dateUpdated": "2026-05-14T03:56:24.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-42919",
"date": "2026-06-27",
"epss": "0.00288",
"percentile": "0.20481"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-42919\",\"sourceIdentifier\":\"f5sirt@f5.com\",\"published\":\"2026-05-13T16:16:49.263\",\"lastModified\":\"2026-06-18T13:54:35.873\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.\\n\\n\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\"}],\"affected\":[{\"source\":\"f5sirt@f5.com\",\"affectedData\":[{\"vendor\":\"F5\",\"product\":\"BIG-IP\",\"defaultStatus\":\"unknown\",\"modules\":[\"All Modules\"],\"versions\":[{\"version\":\"21.1.0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"},{\"version\":\"21.0.0\",\"lessThan\":\"21.0.0.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"17.5.0\",\"lessThan\":\"17.5.1.4\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"17.1.0\",\"lessThan\":\"17.1.3.1\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"16.1.0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"f5sirt@f5.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"f5sirt@f5.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H\",\"baseScore\":6.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-13T00:00:00+00:00\",\"id\":\"CVE-2026-42919\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"f5sirt@f5.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-121\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"84ACD36F-E97D-4DDA-A8FD-D911095C1035\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"BD71EC53-8ABC-410F-B031-0B3288D2E8DF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"1E446AEE-1CB7-411C-9549-0E12C2EBBF9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"AFDDB2A2-3B00-4454-A5BA-F181972B8B70\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"D186FF46-E0B0-4B54-9EA9-87AD379FA600\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"4AFFB39F-3E07-4316-9DD6-C36407B09C20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"06CB53ED-B0CF-45D0-BF6B-C07C2B5AD3DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"A6E75F5E-8C80-4287-84BF-6676B1029AA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"2F330E98-E773-4D93-855D-1D82644B3F73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"26D5B297-AAD7-4DF5-9C24-E9550DF2793A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"59042348-3748-48E0-B78B-D978C6B241B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"5082DEBB-5C7F-41A2-B48F-0C72C3A6782B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"B010CF79-60CD-4B4C-BDCA-61FBD59397B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"39AA59D4-6DE8-4ABA-9EEB-840755CA76A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"6C89D1A8-D453-4A12-97EA-6642F98FDA27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"83FBED4E-1977-45EF-8D33-4A24D81BFE7C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"54BB0364-2EFA-442B-9DB2-3A49677D965C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"F64237A9-9AF0-4D01-958F-753862C33ABF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"2727CEE5-75FD-4345-88C1-3ED60AAF7DE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*\",\"versionStartExcluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"448BBDCD-AD12-4DBB-8CED-46594177260D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"EA180633-8625-4F8E-90E2-235BCD334256\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"66DDBE6D-423A-4F60-9D06-0E10CB93FB66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"35FF40AC-3A3E-4B4B-83F4-BB6048FEBB72\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"E0B21289-FB5C-47FA-B054-50341236260D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"C83BE4EC-8775-4FF4-B362-9E6EBDD53A04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"C7F7C488-8C01-4EE7-A244-259237F06668\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"556AEFC8-8D4C-4E5A-9051-77424FAAC9D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"E649795C-1B70-411B-B744-E0728109474D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"93597117-087D-4AAC-884F-8E1400D645FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"131D329E-0351-402B-BC67-698DC1C9A83E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"2F95824A-E1F8-412E-B59D-8278AE3CB571\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"C8EF0B1D-AE26-4283-8D84-5CECB245652F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"4996DCE3-8F39-4917-96A0-2C44C900DEE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"AA1487CA-A5F3-4689-9458-7309C2E17C9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"48DBF1EA-4DFD-402F-81BC-430B7D74C5FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"7F234CDF-C413-4E70-9A97-6467ADB33EA9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"BA32DFFC-6412-4BA9-9382-5E307539AF4D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"BCBD1B79-3FC1-4288-BEF8-E5D60DA939A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"D25B01D7-F665-47EE-9185-40581A6C3DA0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"83AD64DE-7D0B-4380-89E0-A06817B21606\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.1.0\",\"versionEndIncluding\":\"17.1.3\",\"matchCriteriaId\":\"4AE71FB5-6842-4822-9CA4-1427BC9187BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.5.0\",\"versionEndIncluding\":\"17.5.1\",\"matchCriteriaId\":\"F1516CC2-94CA-4FB2-AC5A-6CFB0580980C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F10F963B-348A-4819-9109-EF0F2304CCDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_advanced_firewall_manager:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"003B47C5-A8E3-4ECD-B0E1-6FD3BCC6C00A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CCCB38CF-FCDA-4E62-8BEA-70DE61D617B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_analytics:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1489ACC-1DCF-4107-A7A5-12E675B522F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_acceleration_manager:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B63EC396-5C6D-4F2B-AA4B-48C19A2DEF40\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_security_manager:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8F401DC-AEE8-4DA1-8D54-51086557F0CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB3D5211-78EA-479C-A468-F3DD867DA377\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_automation_toolchain:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BF32E2A-2837-4F02-98D4-EC8D4AD7629A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_carrier-grade_nat:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7918553F-3A00-4F1F-8007-40C440D30EDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_container_ingress_services:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"63F0B2DD-6D9C-4A4E-AB9A-E417D0BA9725\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"961FD6A4-3969-4A7B-B154-71AB91102EDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_domain_name_system:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0EA3A0ED-753C-4909-8EDC-294AF6873791\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_edge_gateway:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B22E4040-EC36-44B7-AE6F-D8A5B982350F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_fraud_protection_service:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"90819202-D6CE-4742-957E-32653AD75AB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_global_traffic_manager:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E4DCF86-3120-4D11-8233-9E41BF6F1577\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_link_controller:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C3978168-BE6E-41DB-92A2-99843137BBFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_local_traffic_manager:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BBB888F-2AAF-4F90-82F7-12A79A5D9EC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_policy_enforcement_manager:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA18854A-929E-4D5E-B2EC-9AC31A5694C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_ssl_orchestrator:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AB4EFA9A-FBB9-437C-9789-7C4EB489DD59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_webaccelerator:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"900D8242-3139-443E-98A3-30A7D9A0CA42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_websafe:21.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DF82E2E-B438-4205-8A58-802A1F22EB3E\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"BD3A2286-B181-47DA-BCB3-A9D0E0B357AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"004CBB88-E617-4A0A-BE42-E1E6BB52D736\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"920FA89D-E154-4936-B88E-8B60D5B39B40\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"94ADD021-8229-4CDE-AE73-33FB1BD4A3C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"216A1ED3-D0CD-4A08-B9E8-A5B54942E831\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"CA7B9727-7694-4D1B-8B48-175196544050\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"5481F477-166F-4321-80A0-539095C6B829\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"5462B02C-4414-4B14-A671-D8993BD9511D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"4A6B33EA-BD41-45A1-801F-BF2439E4F501\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"972BEB00-AAC3-42F7-BB45-881E1A3D1131\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"226B7285-7977-4BBC-947E-E9541E1AAB89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"8B49FF41-861D-488F-94DC-DAE222A9BE0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"4962EDD5-384F-4ABC-8696-8C4AACEE19BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"CE7A5976-AAA0-4FF1-ADAC-4547F24765FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"5728B748-0795-4056-91E8-B3A0DB3A3081\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"C453B7CE-FBA6-46E7-975D-61D7A18773F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"EC77DFC2-A3DC-46E6-9419-0ABA84CD275E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"25701935-02F5-4BD8-95F0-6693C6606558\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"AC71E265-C7B7-4A78-B73A-32B5FECE5D36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"8B029869-31AB-4FE2-846E-FC6F7133ADF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.1.6\",\"matchCriteriaId\":\"2760AEE2-DCA4-4ED8-92DE-F409EED1A7D9\"}]}]}],\"references\":[{\"url\":\"https://my.f5.com/manage/s/article/K000158971\",\"source\":\"f5sirt@f5.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42919\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-13T15:59:01.314626Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-13T16:14:32.992Z\"}}], \"cna\": {\"title\": \"F5 BIG-IP Appliance Mode Vulnerability\", \"source\": {\"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"F5\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"F5\", \"modules\": [\"All Modules\"], \"product\": \"BIG-IP\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"21.1.0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"21.0.0\", \"lessThan\": \"21.0.0.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"17.5.0\", \"lessThan\": \"17.5.1.4\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"17.1.0\", \"lessThan\": \"17.1.3.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"16.1.0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2026-05-13T14:00:00.000Z\", \"references\": [{\"url\": \"https://my.f5.com/manage/s/article/K000158971\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"x_generator\": {\"engine\": \"F5 SIRTBot v1.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.\\n\\n\\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eA vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.\u003c/span\u003e\\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\u0026nbsp;\u003c/span\u003eNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-121\", \"description\": \"CWE-121 Stack-based Buffer Overflow\"}]}], \"providerMetadata\": {\"orgId\": \"9dacffd4-cb11-413f-8451-fbbfd4ddc0ab\", \"shortName\": \"f5\", \"dateUpdated\": \"2026-05-13T14:12:32.468Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-42919\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-13T16:14:37.510Z\", \"dateReserved\": \"2026-04-30T23:02:47.674Z\", \"assignerOrgId\": \"9dacffd4-cb11-413f-8451-fbbfd4ddc0ab\", \"datePublished\": \"2026-05-13T14:12:32.468Z\", \"assignerShortName\": \"f5\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
CERTFR-2026-AVI-0591
Vulnerability from certfr_avis - Published: 2026-05-15 - Updated: 2026-05-15
De multiples vulnérabilités ont été découvertes dans les produits F5. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| F5 | N/A | BIG-IP APM versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1 | ||
| F5 | N/A | BIG-IP DNS versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1 | ||
| F5 | N/A | BIG-IP Advanced WAF/ASM versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1 | ||
| F5 | BIG-IP | BIG-IP versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1 | ||
| F5 | BIG-IP Next | BIG-IP Next for Kubernetes versions 2.x antérieures à 2.2.0 | ||
| F5 | NGINX | F5 DoS for NGINX versions 4.8.0 | ||
| F5 | BIG-IP | BIG-IP versions 16.1.0 à 16.1.6 antérieures à 17.1.3 | ||
| F5 | N/A | BIG-IP DNS versions 17.5.0 à 17.5.1 antérieures à 21.0.0 | ||
| F5 | BIG-IP Next | BIG-IP Next SPK versions 1.7.0 à 1.7.16 antérieures à 1.7.17 | ||
| F5 | BIG-IP | BIG-IP versions 21.0.x antérieures à 21.0.0.2 | ||
| F5 | N/A | BIG-IP SSL Orchestrator versions 21.0.0 antérieures à 21.0.0.1 (SSL Orchestrator 13.1.3) | ||
| F5 | BIG-IP Next | BIG-IP Next SPK versions 2.0.0 à 2.0.2 antérieures à 2.0.3 | ||
| F5 | NGINX | NGINX Open Source versions 1.0.0 à 1.30.0 antérieures à 1.30.1 | ||
| F5 | N/A | BIG-IP BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1 | ||
| F5 | NGINX | NGINX Gateway Fabric versions 1.3.0 à 1.6.2 | ||
| F5 | BIG-IP Next | BIG-IP Next CNF versions 2.0.0 à 2.0.2 antérieures à 2.0.3 | ||
| F5 | NGINX | NGINX App Protect DoS versions 4.3.0 à 4.7.0 | ||
| F5 | N/A | BIG-IP APM versions 17.5.0 à 17.5.1 antérieures à 17.5.1.4 | ||
| F5 | NGINX | NGINX App Protect WAF versions 4.9.0 à 4.16.0 | ||
| F5 | N/A | BIG-IP SSL Orchestrator versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1 (SSL Orchestrator 12.3.2) | ||
| F5 | NGINX | NGINX Ingress Controller versions 5.0.0 à 5.4.2 | ||
| F5 | BIG-IP | BIG-IP versions 17.5.0 à 17.5.1 antérieures à 21.0.0.2 | ||
| F5 | NGINX | NGINX Ingress Controller versions 3.5.0 à 3.7.2 | ||
| F5 | NGINX | NGINX Open Source versions 0.3.50 à 0.9.7 antérieures à 1.30.1 | ||
| F5 | N/A | BIG-IP DNS versions 21.0.x antérieures à 21.0.0.1 | ||
| F5 | NGINX | NGINX Instance Manager versions 2.16.0 à 2.21.1 | ||
| F5 | N/A | BIG-IP BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender versions 17.5.0 à 17.5.1 antérieures à 17.5.1.4 | ||
| F5 | NGINX | NGINX Plus versions R36 antérieures à R36 P4 | ||
| F5 | BIG-IQ | BIG-IQ Centralized Management versions 8.4.0 antérieures à 8.4.1 | ||
| F5 | N/A | BIG-IP SSL Orchestrator versions 17.5.0 à 17.5.1 antérieures à 17.5.1.4 (SSL Orchestrator 12.3.2) | ||
| F5 | BIG-IP Next | BIG-IP Next CNF versions 1.1.0 à 1.4.0 antérieures à 1.4.1 | ||
| F5 | NGINX | NGINX App Protect WAF versions 5.1.0 à 5.8.0 | ||
| F5 | NGINX | NGINX Gateway Fabric versions 2.0.0 à 2.6.0 | ||
| F5 | NGINX | NGINX Ingress Controller versions 4.0.0 à 4.0.1 | ||
| F5 | N/A | BIG-IP PEM versions 17.1.0 à 17.1.3 antérieures à 17.1.3.1 | ||
| F5 | N/A | BIG-IP APM versions 21.0.x antérieures à 21.0.0.1 | ||
| F5 | N/A | BIG-IP DNS versions 16.1.0 à 16.1.6 antérieures à 17.1.3.1 | ||
| F5 | N/A | BIG-IP PEM versions 21.0.x antérieures à 21.0.0.1 | ||
| F5 | N/A | BIG-IP Advanced WAF/ASM versions 17.5.0 à 17.5.1 antérieures à 17.5.1.4 | ||
| F5 | N/A | BIG-IP Advanced WAF/ASM versions 21.0.x antérieures à 21.0.0.1 | ||
| F5 | N/A | BIG-IP PEM versions 17.5.0 à 17.5.1 antérieures à 17.5.1.4 | ||
| F5 | NGINX | NGINX Plus versions R32 antérieures à R32 P6 | ||
| F5 | NGINX | F5 WAF for NGINX versions 5.9.0 à 5.12.1 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "BIG-IP APM versions 17.1.0 \u00e0 17.1.3 ant\u00e9rieures \u00e0 17.1.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP DNS versions 17.1.0 \u00e0 17.1.3 ant\u00e9rieures \u00e0 17.1.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP Advanced WAF/ASM versions 17.1.0 \u00e0 17.1.3 ant\u00e9rieures \u00e0 17.1.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP versions 17.1.0 \u00e0 17.1.3 ant\u00e9rieures \u00e0 17.1.3.1",
"product": {
"name": "BIG-IP",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP Next for Kubernetes versions 2.x ant\u00e9rieures \u00e0 2.2.0",
"product": {
"name": "BIG-IP Next",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "F5 DoS for NGINX versions 4.8.0",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP versions 16.1.0 \u00e0 16.1.6 ant\u00e9rieures \u00e0 17.1.3",
"product": {
"name": "BIG-IP",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP DNS versions 17.5.0 \u00e0 17.5.1 ant\u00e9rieures \u00e0 21.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP Next SPK versions 1.7.0 \u00e0 1.7.16 ant\u00e9rieures \u00e0 1.7.17",
"product": {
"name": "BIG-IP Next",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP versions 21.0.x ant\u00e9rieures \u00e0 21.0.0.2",
"product": {
"name": "BIG-IP",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP SSL Orchestrator versions 21.0.0 ant\u00e9rieures \u00e0 21.0.0.1 (SSL Orchestrator 13.1.3)",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP Next SPK versions 2.0.0 \u00e0 2.0.2 ant\u00e9rieures \u00e0 2.0.3",
"product": {
"name": "BIG-IP Next",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "NGINX Open Source versions 1.0.0 \u00e0 1.30.0 ant\u00e9rieures \u00e0 1.30.1",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender versions 17.1.0 \u00e0 17.1.3 ant\u00e9rieures \u00e0 17.1.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "NGINX Gateway Fabric versions 1.3.0 \u00e0 1.6.2",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP Next CNF versions 2.0.0 \u00e0 2.0.2 ant\u00e9rieures \u00e0 2.0.3",
"product": {
"name": "BIG-IP Next",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "NGINX App Protect DoS versions 4.3.0 \u00e0 4.7.0",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP APM versions 17.5.0 \u00e0 17.5.1 ant\u00e9rieures \u00e0 17.5.1.4",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "NGINX App Protect WAF versions 4.9.0 \u00e0 4.16.0",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP SSL Orchestrator versions 17.1.0 \u00e0 17.1.3 ant\u00e9rieures \u00e0 17.1.3.1 (SSL Orchestrator 12.3.2)",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "NGINX Ingress Controller versions 5.0.0 \u00e0 5.4.2",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP versions 17.5.0 \u00e0 17.5.1 ant\u00e9rieures \u00e0 21.0.0.2",
"product": {
"name": "BIG-IP",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "NGINX Ingress Controller versions 3.5.0 \u00e0 3.7.2",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "NGINX Open Source versions 0.3.50 \u00e0 0.9.7 ant\u00e9rieures \u00e0 1.30.1",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP DNS versions 21.0.x ant\u00e9rieures \u00e0 21.0.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "NGINX Instance Manager versions 2.16.0 \u00e0 2.21.1",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender versions 17.5.0 \u00e0 17.5.1 ant\u00e9rieures \u00e0 17.5.1.4",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "NGINX Plus versions R36 ant\u00e9rieures \u00e0 R36 P4",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IQ Centralized Management versions 8.4.0 ant\u00e9rieures \u00e0 8.4.1",
"product": {
"name": "BIG-IQ",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP SSL Orchestrator versions 17.5.0 \u00e0 17.5.1 ant\u00e9rieures \u00e0 17.5.1.4 (SSL Orchestrator 12.3.2)",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP Next CNF versions 1.1.0 \u00e0 1.4.0 ant\u00e9rieures \u00e0 1.4.1",
"product": {
"name": "BIG-IP Next",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "NGINX App Protect WAF versions 5.1.0 \u00e0 5.8.0",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "NGINX Gateway Fabric versions 2.0.0 \u00e0 2.6.0",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "NGINX Ingress Controller versions 4.0.0 \u00e0 4.0.1",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP PEM versions 17.1.0 \u00e0 17.1.3 ant\u00e9rieures \u00e0 17.1.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP APM versions 21.0.x ant\u00e9rieures \u00e0 21.0.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP DNS versions 16.1.0 \u00e0 16.1.6 ant\u00e9rieures \u00e0 17.1.3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP PEM versions 21.0.x ant\u00e9rieures \u00e0 21.0.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP Advanced WAF/ASM versions 17.5.0 \u00e0 17.5.1 ant\u00e9rieures \u00e0 17.5.1.4",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP Advanced WAF/ASM versions 21.0.x ant\u00e9rieures \u00e0 21.0.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "BIG-IP PEM versions 17.5.0 \u00e0 17.5.1 ant\u00e9rieures \u00e0 17.5.1.4",
"product": {
"name": "N/A",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "NGINX Plus versions R32 ant\u00e9rieures \u00e0 R32 P6",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
},
{
"description": "F5 WAF for NGINX versions 5.9.0 \u00e0 5.12.1",
"product": {
"name": "NGINX",
"vendor": {
"name": "F5",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-41227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41227"
},
{
"name": "CVE-2026-39458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39458"
},
{
"name": "CVE-2026-42781",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42781"
},
{
"name": "CVE-2026-42780",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42780"
},
{
"name": "CVE-2026-40701",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40701"
},
{
"name": "CVE-2026-42920",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42920"
},
{
"name": "CVE-2026-42409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42409"
},
{
"name": "CVE-2026-42946",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42946"
},
{
"name": "CVE-2026-42937",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42937"
},
{
"name": "CVE-2026-42919",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42919"
},
{
"name": "CVE-2026-42934",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42934"
},
{
"name": "CVE-2026-42406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42406"
},
{
"name": "CVE-2026-40435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40435"
},
{
"name": "CVE-2026-34176",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34176"
},
{
"name": "CVE-2026-40629",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40629"
},
{
"name": "CVE-2026-32673",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32673"
},
{
"name": "CVE-2026-41953",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41953"
},
{
"name": "CVE-2026-40061",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40061"
},
{
"name": "CVE-2026-42924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42924"
},
{
"name": "CVE-2026-41225",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41225"
},
{
"name": "CVE-2026-35062",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35062"
},
{
"name": "CVE-2026-40423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40423"
},
{
"name": "CVE-2026-34019",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34019"
},
{
"name": "CVE-2026-42926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42926"
},
{
"name": "CVE-2026-20916",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20916"
},
{
"name": "CVE-2026-41957",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41957"
},
{
"name": "CVE-2026-39455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39455"
},
{
"name": "CVE-2026-40618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40618"
},
{
"name": "CVE-2026-40631",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40631"
},
{
"name": "CVE-2026-32643",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32643"
},
{
"name": "CVE-2026-41217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41217"
},
{
"name": "CVE-2026-40698",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40698"
},
{
"name": "CVE-2026-39459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39459"
},
{
"name": "CVE-2026-40703",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40703"
},
{
"name": "CVE-2026-28758",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28758"
},
{
"name": "CVE-2026-41954",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41954"
},
{
"name": "CVE-2026-40699",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40699"
},
{
"name": "CVE-2026-40462",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40462"
},
{
"name": "CVE-2026-41219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41219"
},
{
"name": "CVE-2026-24464",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24464"
},
{
"name": "CVE-2026-40067",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40067"
},
{
"name": "CVE-2026-42063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42063"
},
{
"name": "CVE-2026-42408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42408"
},
{
"name": "CVE-2026-40060",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40060"
},
{
"name": "CVE-2026-42945",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42945"
},
{
"name": "CVE-2026-41956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41956"
},
{
"name": "CVE-2026-41218",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41218"
},
{
"name": "CVE-2026-41959",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41959"
},
{
"name": "CVE-2026-42930",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42930"
},
{
"name": "CVE-2026-40460",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40460"
},
{
"name": "CVE-2026-42058",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42058"
}
],
"initial_release_date": "2026-05-15T00:00:00",
"last_revision_date": "2026-05-15T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0591",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-05-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits F5. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits F5",
"vendor_advisories": [
{
"published_at": "2026-05-13",
"title": "Bulletin de s\u00e9curit\u00e9 F5 K000160932",
"url": "https://my.f5.com/manage/s/article/K000160932"
}
]
}
Title
F5 BIG-IP堆栈缓冲区溢出漏洞
Description
F5 BIG-IP是美国F5公司的一款集成了网络流量管理、应用程序安全管理、负载均衡等功能的应用交付平台。
F5 BIG-IP存在堆栈缓冲区溢出漏洞，该漏洞源于权限管理问题，攻击者可利用该漏洞导致经过身份验证的管理员权限提升并跨越安全边界。
Severity
高
Patch Name
F5 BIG-IP堆栈缓冲区溢出漏洞的补丁
Patch Description
F5 BIG-IP是美国F5公司的一款集成了网络流量管理、应用程序安全管理、负载均衡等功能的应用交付平台。
F5 BIG-IP存在堆栈缓冲区溢出漏洞，该漏洞源于权限管理问题，攻击者可利用该漏洞导致经过身份验证的管理员权限提升并跨越安全边界。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
厂商已发布了漏洞修复程序，请及时关注更新： https://my.f5.com/manage/s/article/K000158971
Reference
https://my.f5.com/manage/s/article/K000158971
Impacted products
| Name | ['F5 BIG-IP (all modules) 21.0.0', 'F5 BIG-IP (all modules) >=17.5.0，<=17.5.1', 'F5 BIG-IP (all modules) >=17.1.0，<=17.1.3', 'F5 BIG-IP (all modules) >=16.1.0，<=16.1.6'] |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2026-42919",
"cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-42919"
}
},
"description": "F5 BIG-IP\u662f\u7f8e\u56fdF5\u516c\u53f8\u7684\u4e00\u6b3e\u96c6\u6210\u4e86\u7f51\u7edc\u6d41\u91cf\u7ba1\u7406\u3001\u5e94\u7528\u7a0b\u5e8f\u5b89\u5168\u7ba1\u7406\u3001\u8d1f\u8f7d\u5747\u8861\u7b49\u529f\u80fd\u7684\u5e94\u7528\u4ea4\u4ed8\u5e73\u53f0\u3002 \n\nF5 BIG-IP\u5b58\u5728\u5806\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u6743\u9650\u7ba1\u7406\u95ee\u9898\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u7ba1\u7406\u5458\u6743\u9650\u63d0\u5347\u5e76\u8de8\u8d8a\u5b89\u5168\u8fb9\u754c\u3002",
"formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://my.f5.com/manage/s/article/K000158971",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2026-21368",
"openTime": "2026-05-22",
"patchDescription": "F5 BIG-IP\u662f\u7f8e\u56fdF5\u516c\u53f8\u7684\u4e00\u6b3e\u96c6\u6210\u4e86\u7f51\u7edc\u6d41\u91cf\u7ba1\u7406\u3001\u5e94\u7528\u7a0b\u5e8f\u5b89\u5168\u7ba1\u7406\u3001\u8d1f\u8f7d\u5747\u8861\u7b49\u529f\u80fd\u7684\u5e94\u7528\u4ea4\u4ed8\u5e73\u53f0\u3002 \r\n\r\nF5 BIG-IP\u5b58\u5728\u5806\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u6743\u9650\u7ba1\u7406\u95ee\u9898\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u7ba1\u7406\u5458\u6743\u9650\u63d0\u5347\u5e76\u8de8\u8d8a\u5b89\u5168\u8fb9\u754c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "F5 BIG-IP\u5806\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": [
"F5 BIG-IP (all modules) 21.0.0",
"F5 BIG-IP (all modules) \u003e=17.5.0\uff0c\u003c=17.5.1",
"F5 BIG-IP (all modules) \u003e=17.1.0\uff0c\u003c=17.1.3",
"F5 BIG-IP (all modules) \u003e=16.1.0\uff0c\u003c=16.1.6"
]
},
"referenceLink": "https://my.f5.com/manage/s/article/K000158971",
"serverity": "\u9ad8",
"submitTime": "2026-05-14",
"title": "F5 BIG-IP\u5806\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}
FKIE_CVE-2026-42919
Vulnerability from fkie_nvd - Published: 2026-05-13 16:16 - Updated: 2026-06-18 13:54
Severity
Summary
A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
References
| URL | Tags | ||
|---|---|---|---|
| f5sirt@f5.com | https://my.f5.com/manage/s/article/K000158971 | Mitigation, Vendor Advisory |
Impacted products
{
"affected": [
{
"affectedData": [
{
"defaultStatus": "unknown",
"modules": [
"All Modules"
],
"product": "BIG-IP",
"vendor": "F5",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "21.1.0",
"versionType": "custom"
},
{
"lessThan": "21.0.0.1",
"status": "affected",
"version": "21.0.0",
"versionType": "custom"
},
{
"lessThan": "17.5.1.4",
"status": "affected",
"version": "17.5.0",
"versionType": "custom"
},
{
"lessThan": "17.1.3.1",
"status": "affected",
"version": "17.1.0",
"versionType": "custom"
},
{
"lessThan": "*",
"status": "affected",
"version": "16.1.0",
"versionType": "custom"
}
]
}
],
"source": "f5sirt@f5.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "84ACD36F-E97D-4DDA-A8FD-D911095C1035",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BD71EC53-8ABC-410F-B031-0B3288D2E8DF",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1E446AEE-1CB7-411C-9549-0E12C2EBBF9C",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFDDB2A2-3B00-4454-A5BA-F181972B8B70",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D186FF46-E0B0-4B54-9EA9-87AD379FA600",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4AFFB39F-3E07-4316-9DD6-C36407B09C20",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "06CB53ED-B0CF-45D0-BF6B-C07C2B5AD3DA",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A6E75F5E-8C80-4287-84BF-6676B1029AA6",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2F330E98-E773-4D93-855D-1D82644B3F73",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "26D5B297-AAD7-4DF5-9C24-E9550DF2793A",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "59042348-3748-48E0-B78B-D978C6B241B2",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5082DEBB-5C7F-41A2-B48F-0C72C3A6782B",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B010CF79-60CD-4B4C-BDCA-61FBD59397B9",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
"matchCriteriaId": "39AA59D4-6DE8-4ABA-9EEB-840755CA76A2",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6C89D1A8-D453-4A12-97EA-6642F98FDA27",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83FBED4E-1977-45EF-8D33-4A24D81BFE7C",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
"matchCriteriaId": "54BB0364-2EFA-442B-9DB2-3A49677D965C",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F64237A9-9AF0-4D01-958F-753862C33ABF",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2727CEE5-75FD-4345-88C1-3ED60AAF7DE3",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*",
"matchCriteriaId": "448BBDCD-AD12-4DBB-8CED-46594177260D",
"versionEndIncluding": "17.5.1",
"versionStartExcluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EA180633-8625-4F8E-90E2-235BCD334256",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
"matchCriteriaId": "66DDBE6D-423A-4F60-9D06-0E10CB93FB66",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "35FF40AC-3A3E-4B4B-83F4-BB6048FEBB72",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E0B21289-FB5C-47FA-B054-50341236260D",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C83BE4EC-8775-4FF4-B362-9E6EBDD53A04",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C7F7C488-8C01-4EE7-A244-259237F06668",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
"matchCriteriaId": "556AEFC8-8D4C-4E5A-9051-77424FAAC9D1",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E649795C-1B70-411B-B744-E0728109474D",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "93597117-087D-4AAC-884F-8E1400D645FA",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "131D329E-0351-402B-BC67-698DC1C9A83E",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2F95824A-E1F8-412E-B59D-8278AE3CB571",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C8EF0B1D-AE26-4283-8D84-5CECB245652F",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4996DCE3-8F39-4917-96A0-2C44C900DEE0",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AA1487CA-A5F3-4689-9458-7309C2E17C9E",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48DBF1EA-4DFD-402F-81BC-430B7D74C5FD",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7F234CDF-C413-4E70-9A97-6467ADB33EA9",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BA32DFFC-6412-4BA9-9382-5E307539AF4D",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BCBD1B79-3FC1-4288-BEF8-E5D60DA939A6",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D25B01D7-F665-47EE-9185-40581A6C3DA0",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83AD64DE-7D0B-4380-89E0-A06817B21606",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4AE71FB5-6842-4822-9CA4-1427BC9187BF",
"versionEndIncluding": "17.1.3",
"versionStartIncluding": "17.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F1516CC2-94CA-4FB2-AC5A-6CFB0580980C",
"versionEndIncluding": "17.5.1",
"versionStartIncluding": "17.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F10F963B-348A-4819-9109-EF0F2304CCDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "003B47C5-A8E3-4ECD-B0E1-6FD3BCC6C00A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCCB38CF-FCDA-4E62-8BEA-70DE61D617B4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_analytics:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B1489ACC-1DCF-4107-A7A5-12E675B522F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B63EC396-5C6D-4F2B-AA4B-48C19A2DEF40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E8F401DC-AEE8-4DA1-8D54-51086557F0CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EB3D5211-78EA-479C-A468-F3DD867DA377",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BF32E2A-2837-4F02-98D4-EC8D4AD7629A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7918553F-3A00-4F1F-8007-40C440D30EDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "63F0B2DD-6D9C-4A4E-AB9A-E417D0BA9725",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "961FD6A4-3969-4A7B-B154-71AB91102EDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0EA3A0ED-753C-4909-8EDC-294AF6873791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B22E4040-EC36-44B7-AE6F-D8A5B982350F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90819202-D6CE-4742-957E-32653AD75AB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5E4DCF86-3120-4D11-8233-9E41BF6F1577",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C3978168-BE6E-41DB-92A2-99843137BBFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2BBB888F-2AAF-4F90-82F7-12A79A5D9EC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA18854A-929E-4D5E-B2EC-9AC31A5694C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AB4EFA9A-FBB9-437C-9789-7C4EB489DD59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "900D8242-3139-443E-98A3-30A7D9A0CA42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_websafe:21.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4DF82E2E-B438-4205-8A58-802A1F22EB3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BD3A2286-B181-47DA-BCB3-A9D0E0B357AC",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "004CBB88-E617-4A0A-BE42-E1E6BB52D736",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
"matchCriteriaId": "920FA89D-E154-4936-B88E-8B60D5B39B40",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "94ADD021-8229-4CDE-AE73-33FB1BD4A3C5",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "216A1ED3-D0CD-4A08-B9E8-A5B54942E831",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CA7B9727-7694-4D1B-8B48-175196544050",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5481F477-166F-4321-80A0-539095C6B829",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5462B02C-4414-4B14-A671-D8993BD9511D",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4A6B33EA-BD41-45A1-801F-BF2439E4F501",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*",
"matchCriteriaId": "972BEB00-AAC3-42F7-BB45-881E1A3D1131",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
"matchCriteriaId": "226B7285-7977-4BBC-947E-E9541E1AAB89",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8B49FF41-861D-488F-94DC-DAE222A9BE0D",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4962EDD5-384F-4ABC-8696-8C4AACEE19BD",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CE7A5976-AAA0-4FF1-ADAC-4547F24765FA",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5728B748-0795-4056-91E8-B3A0DB3A3081",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C453B7CE-FBA6-46E7-975D-61D7A18773F9",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EC77DFC2-A3DC-46E6-9419-0ABA84CD275E",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "25701935-02F5-4BD8-95F0-6693C6606558",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AC71E265-C7B7-4A78-B73A-32B5FECE5D36",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8B029869-31AB-4FE2-846E-FC6F7133ADF8",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2760AEE2-DCA4-4ED8-92DE-F409EED1A7D9",
"versionEndIncluding": "16.1.6",
"versionStartIncluding": "16.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.\n\n\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
}
],
"id": "CVE-2026-42919",
"lastModified": "2026-06-18T13:54:35.873",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.5,
"source": "f5sirt@f5.com",
"type": "Secondary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "f5sirt@f5.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-42919",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T00:00:00+00:00",
"version": "2.0.3"
}
}
]
},
"published": "2026-05-13T16:16:49.263",
"references": [
{
"source": "f5sirt@f5.com",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://my.f5.com/manage/s/article/K000158971"
}
],
"sourceIdentifier": "f5sirt@f5.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-121"
}
],
"source": "f5sirt@f5.com",
"type": "Secondary"
}
]
}
GHSA-W3XH-P84J-V7QW
Vulnerability from github – Published: 2026-05-13 18:30 – Updated: 2026-05-13 18:30
VLAI
Details
A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-42919"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-13T16:16:49Z",
"severity": "HIGH"
},
"details": "A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.\n\n\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"id": "GHSA-w3xh-p84j-v7qw",
"modified": "2026-05-13T18:30:56Z",
"published": "2026-05-13T18:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42919"
},
{
"type": "WEB",
"url": "https://my.f5.com/manage/s/article/K000158971"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
NCSC-2026-0162
Vulnerability from csaf_ncscnl - Published: 2026-05-15 12:07 - Updated: 2026-05-15 12:07Summary
Kwetsbaarheden verholpen in F5 BIG-IP en BIG-IQ producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: F5 heeft meerdere kwetsbaarheden verholpen in de BIG-IP en BIG-IQ productlijnen, inclusief componenten zoals iControl REST, iControl SOAP, TMOS Shell, Traffic Management Microkernel (TMM), Configuration utility, Advanced WAF, ASM, PEM, DNS, Access Policy Manager (APM) en SSL Orchestrator.
Interpretaties: De kwetsbaarheden betreffen onder andere directory traversal, ongeautoriseerde bestandswijzigingen, blootstelling van gevoelige SSH-wachtwoorden in API-responses en auditlogs, privilege escalatie via onjuiste permissie-toewijzingen, remote command injection, cross-account informatielekken, en onverwachte procesafsluitingen (zoals van TMM, httpd, apmd en bd processen) door specifieke configuraties of ongedocumenteerde verkeerspatronen.
Exploitatie vereist doorgaans geauthenticeerde toegang met rollen variërend van Manager, Resource Administrator tot Administrator, afhankelijk van de kwetsbaarheid. Sommige kwetsbaarheden maken het mogelijk om configuratieobjecten te wijzigen, wat kan leiden tot het uitvoeren van willekeurige commando's met verhoogde privileges.
Andere kwetsbaarheden betreffen het lekken van gevoelige informatie via onjuiste toegangscontrole of onvoldoende validatie binnen managementinterfaces. Diverse kwetsbaarheden zijn specifiek voor Appliance mode of bepaalde configuratieprofielen zoals SSL, HTTP/2, SIP, LDAP authenticatie, en SNMP configuraties. De impact omvat onder meer het omzeilen van beveiligingscontroles, het escaleren van privileges, het lekken van gevoelige gegevens, en het verstoren van de beschikbaarheid en stabiliteit van netwerk- en applicatiebeheercomponenten. Niet-ondersteunde softwareversies zijn in de meeste gevallen niet geëvalueerd voor deze kwetsbaarheden.
Oplossingen: F5 heeft updates uitgebracht om de kwetsbaarheden in de BIG-IP en BIG-IQ producten te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-35: Path Traversal: '.../...//'
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-121: Stack-based Buffer Overflow
CWE-131: Incorrect Calculation of Buffer Size
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-250: Execution with Unnecessary Privileges
CWE-252: Unchecked Return Value
CWE-266: Incorrect Privilege Assignment
CWE-267: Privilege Defined With Unsafe Actions
CWE-272: Least Privilege Violation
CWE-312: Cleartext Storage of Sensitive Information
CWE-352: Cross-Site Request Forgery (CSRF)
CWE-416: Use After Free
CWE-420: Unprotected Alternate Channel
CWE-476: NULL Pointer Dereference
CWE-502: Deserialization of Untrusted Data
CWE-532: Insertion of Sensitive Information into Log File
CWE-552: Files or Directories Accessible to External Parties
CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')
CWE-648: Incorrect Use of Privileged APIs
CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-772: Missing Release of Resource after Effective Lifetime
CWE-824: Access of Uninitialized Pointer
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
A directory traversal vulnerability in an undisclosed iControl REST endpoint in Appliance mode may allow an authenticated administrator to bypass security boundaries and delete files.
6.8 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in BIG-IP DNS's gtm_add and bigip_add iControl REST commands exposes the ssh-password parameter in cleartext within responses and audit logs, risking sensitive information disclosure to highly privileged attackers.
4.4 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in BIG-IP and BIG-IQ systems allows a highly privileged, authenticated attacker with at least the Certificate Manager role to modify configuration objects and execute arbitrary commands, excluding versions past End of Technical Support.
8.7 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in BIG-IP scripted monitors allows authenticated users with Resource Administrator or Administrator roles to execute arbitrary system commands with elevated privileges, potentially crossing security boundaries in appliance mode.
8.7 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
An authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint in Appliance mode, potentially allowing an attacker to cross security boundaries.
8.7 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
An authenticated iControl SOAP user may be able to access or obtain information from other accounts, with versions past End of Technical Support not evaluated.
6.5 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Configuring the BIG-IP Configuration utility to use LDAP authentication can cause the httpd process to exhaust available file descriptors due to undisclosed traffic, with unsupported software versions not evaluated.
7.5 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Enabling a BIG-IP DNS profile with DNS cache on a virtual server can cause the Traffic Management Microkernel (TMM) to terminate due to undisclosed traffic, with unsupported software versions not evaluated.
7.5 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in iControl REST and TMOS Shell (tmsh) allows a highly privileged, authenticated attacker with at least Manager role to create configuration objects that enable execution of arbitrary commands.
7.2 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Certain undisclosed requests can cause the bd process to terminate when a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, with unsupported software versions not evaluated.
7.5 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in BIG-IP DNS allows authenticated Resource Administrator or Administrator users to execute arbitrary system commands with elevated privileges, potentially crossing security boundaries in Appliance mode.
8.7 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Configuring a BIG-IP APM access policy on a virtual server can cause the apmd process to terminate due to undisclosed traffic, with unsupported software versions not evaluated.
7.5 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Configuring a SIP profile on a virtual server can cause the Traffic Management Microkernel (TMM) to terminate due to undisclosed traffic, with issues noted in software versions beyond End of Technical Support (EoTS).
7.5 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
IP-based access restrictions configured for httpd do not apply to all endpoints, potentially allowing connections from blocked IP addresses, except in versions that have reached End of Technical Support.
5.3 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Incorrect permission assignment vulnerabilities in iControl REST and TMOS Shell (tmsh) undisclosed commands may allow authenticated attackers to access sensitive information.
6.5 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Configuring an SSL profile on BIG-IP Virtual Edition without Intel QAT or on hardware with crypto.hwacceleration disabled can cause the Traffic Management Microkernel (TMM) to terminate when processing certain undisclosed traffic.
7.5 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Configuring SSL profiles on a virtual server can cause the server to stop processing new client connections when handling undisclosed traffic, with versions beyond End of Technical Support not evaluated.
7.5 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
An authenticated attacker with Resource Administrator or Administrator roles can exploit iControl SOAP to modify configuration objects and escalate privileges, with unsupported software versions not evaluated.
8.7 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in F5 BIG-IP and BIG-IQ systems allows a highly privileged, authenticated attacker with Resource Administrator role to create SNMP configuration objects via iControl REST or TMOS shell, resulting in privilege escalation.
8.7 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in undisclosed pages of the Configuration utility may allow a low-privileged authenticated attacker to access sensitive information, with unsupported software versions not evaluated.
6.5 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility, with versions that have reached End of Technical Support (EoTS) not evaluated.
5.4 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in an undisclosed BIG-IP TMOS Shell command allows authenticated users with resource administrator or administrator roles to execute arbitrary system commands with elevated privileges, potentially crossing security boundaries in Appliance mode.
7.9 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Configuring BIG-IP PEM iRules with certain commands on a virtual server can cause the Traffic Management Microkernel (TMM) to terminate, with unsupported software versions not evaluated.
7.5 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
An improper sanitization vulnerability in the BIG-IP QKView utility allows low-privileged attackers to read sensitive information from QKView files, with unsupported software versions not evaluated.
6.5 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in iControl REST allows a highly privileged, authenticated attacker with at least Manager role to create configuration objects that enable arbitrary command execution.
9.1 (Critical)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Certain undisclosed traffic on an HTTP/2 virtual server with Layer 7 DoS Protection can increase memory usage and cause the Traffic Management Microkernel (TMM) process to terminate.
7.5 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in BIG-IP systems enables a highly privileged, authenticated attacker with at least Resource Administrator role to modify configuration objects, resulting in privilege escalation.
8.7 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A sensitive information disclosure vulnerability in an undisclosed iControl REST endpoint and TMOS Shell (tmsh) command may allow an authenticated attacker with resource administrator privileges to access sensitive information.
4.9 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Configuring a classification profile on a UDP virtual server can cause the Traffic Management Microkernel (TMM) to terminate upon receiving certain undisclosed requests, with unsupported software versions not evaluated.
7.5 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
An authenticated remote code execution vulnerability exists in the BIG-IP and BIG-IQ Configuration utility through undisclosed vectors, excluding software versions that have reached End of Technical Support.
8.8 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Incorrect permission assignment vulnerabilities in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and BIG-IP iControl REST may allow authenticated attackers to view network status of destination systems.
6.5 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
An authenticated attacker can exploit undisclosed requests to BIG-IP iControl REST to leak local user account names, with unsupported software versions not evaluated.
4.3 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in iControl SOAP allows authenticated users with Resource Administrator or Administrator roles to download sensitive files, with unsupported software versions not evaluated.
4.9 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in BIG-IP and BIG-IQ systems allows a highly privileged, authenticated attacker with the Certificate Manager role to modify configuration objects and execute arbitrary commands, excluding versions past End of Technical Support.
8.7 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in an undisclosed TMOS Shell (tmsh) command in BIG-IP DNS may allow a highly privileged authenticated attacker to view sensitive information.
4.4 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Configuring an HTTP/2 profile with an iRule using HTTP::redirect or HTTP::respond on a virtual server can cause the Traffic Management Microkernel (TMM) process to terminate due to certain request handling issues.
7.5 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A directory traversal vulnerability in BIG-IP SSL Orchestrator allows an authenticated high-privilege attacker to overwrite, delete, or corrupt arbitrary local files, affecting supported software versions.
4.9 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Configuring embedded Packet Velocity Acceleration (ePVA) can increase resource utilization in ePVA and Traffic Management Microkernel (TMM) due to undisclosed local ethernet traffic, with unsupported software versions not evaluated.
6.5 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
A vulnerability in BIG-IP systems allows an authenticated attacker with administrative access to escalate privileges and cross security boundaries, with unsupported software versions not evaluated.
6.7 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Configuring a Client SSL profile with Allow Dynamic Record Sizing on a UDP virtual server can cause the Traffic Management Microkernel (TMM) to terminate due to undisclosed traffic issues.
7.5 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
An authenticated attacker with Resource Administrator or Administrator roles can exploit iControl SOAP to create SNMP configuration objects, leading to privilege escalation.
8.7 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
An authenticated attacker with Administrator privileges may bypass Appliance mode restrictions on a BIG-IP system, including some unsupported software versions not evaluated.
8.7 (High)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
Incorrect permission assignment vulnerabilities in BIG-IP and BIG-IQ TMOS Shell arp and ndp commands, as well as in BIG-IP iControl REST, may allow an authenticated attacker to access adjacent network information.
6.5 (Medium)
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
F5 / AI Gateway
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP APM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP DNS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next CNF
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next SPK
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP Next for Kubernetes
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP PEM
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX110 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on BX520 blades on VELOS
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on all other rSeries systems
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r10000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r12000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IP tenants on r5000 rSeries
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / BIG-IQ Centralized Management
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Distributed Cloud (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / NGINX (all products)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-A
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / OS-C
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / SSL Orchestrator
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Silverline (all services)
|
vers:unknown/* | ||
|
vers:unknown/*
F5 / Traffix SDC
|
vers:unknown/* |
References
84 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "F5 heeft meerdere kwetsbaarheden verholpen in de BIG-IP en BIG-IQ productlijnen, inclusief componenten zoals iControl REST, iControl SOAP, TMOS Shell, Traffic Management Microkernel (TMM), Configuration utility, Advanced WAF, ASM, PEM, DNS, Access Policy Manager (APM) en SSL Orchestrator.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden betreffen onder andere directory traversal, ongeautoriseerde bestandswijzigingen, blootstelling van gevoelige SSH-wachtwoorden in API-responses en auditlogs, privilege escalatie via onjuiste permissie-toewijzingen, remote command injection, cross-account informatielekken, en onverwachte procesafsluitingen (zoals van TMM, httpd, apmd en bd processen) door specifieke configuraties of ongedocumenteerde verkeerspatronen.\n\nExploitatie vereist doorgaans geauthenticeerde toegang met rollen vari\u00ebrend van Manager, Resource Administrator tot Administrator, afhankelijk van de kwetsbaarheid. Sommige kwetsbaarheden maken het mogelijk om configuratieobjecten te wijzigen, wat kan leiden tot het uitvoeren van willekeurige commando\u0027s met verhoogde privileges.\n\nAndere kwetsbaarheden betreffen het lekken van gevoelige informatie via onjuiste toegangscontrole of onvoldoende validatie binnen managementinterfaces. Diverse kwetsbaarheden zijn specifiek voor Appliance mode of bepaalde configuratieprofielen zoals SSL, HTTP/2, SIP, LDAP authenticatie, en SNMP configuraties. De impact omvat onder meer het omzeilen van beveiligingscontroles, het escaleren van privileges, het lekken van gevoelige gegevens, en het verstoren van de beschikbaarheid en stabiliteit van netwerk- en applicatiebeheercomponenten. Niet-ondersteunde softwareversies zijn in de meeste gevallen niet ge\u00ebvalueerd voor deze kwetsbaarheden.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "F5 heeft updates uitgebracht om de kwetsbaarheden in de BIG-IP en BIG-IQ producten te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "Path Traversal: \u0027.../...//\u0027",
"title": "CWE-35"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"title": "CWE-77"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "general",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "general",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "general",
"text": "Incorrect Calculation of Buffer Size",
"title": "CWE-131"
},
{
"category": "general",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "Execution with Unnecessary Privileges",
"title": "CWE-250"
},
{
"category": "general",
"text": "Unchecked Return Value",
"title": "CWE-252"
},
{
"category": "general",
"text": "Incorrect Privilege Assignment",
"title": "CWE-266"
},
{
"category": "general",
"text": "Privilege Defined With Unsafe Actions",
"title": "CWE-267"
},
{
"category": "general",
"text": "Least Privilege Violation",
"title": "CWE-272"
},
{
"category": "general",
"text": "Cleartext Storage of Sensitive Information",
"title": "CWE-312"
},
{
"category": "general",
"text": "Cross-Site Request Forgery (CSRF)",
"title": "CWE-352"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "Unprotected Alternate Channel",
"title": "CWE-420"
},
{
"category": "general",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "Insertion of Sensitive Information into Log File",
"title": "CWE-532"
},
{
"category": "general",
"text": "Files or Directories Accessible to External Parties",
"title": "CWE-552"
},
{
"category": "general",
"text": "Improper Neutralization of Data within XPath Expressions (\u0027XPath Injection\u0027)",
"title": "CWE-643"
},
{
"category": "general",
"text": "Incorrect Use of Privileged APIs",
"title": "CWE-648"
},
{
"category": "general",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "Missing Release of Resource after Effective Lifetime",
"title": "CWE-772"
},
{
"category": "general",
"text": "Access of Uninitialized Pointer",
"title": "CWE-824"
},
{
"category": "general",
"text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"title": "CWE-835"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160975"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160979"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160981"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000161018"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000161022"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000161023"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000161040"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000161056"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000161107"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000149743"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000156581"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000156604"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000156761"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000156734"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000157895"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000157981"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000158038"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000158070"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000158082"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000158971"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000158978"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000158979"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000159021"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000159034"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160727"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160788"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160857"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160862"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160863"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160874"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160875"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160876"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160901"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160903"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160911"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160916"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160926"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160945"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160971"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160972"
},
{
"category": "external",
"summary": "Reference",
"url": "https://my.f5.com/manage/s/article/K000160973"
}
],
"title": "Kwetsbaarheden verholpen in F5 BIG-IP en BIG-IQ producten",
"tracking": {
"current_release_date": "2026-05-15T12:07:48.313135Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0162",
"initial_release_date": "2026-05-15T12:07:48.313135Z",
"revision_history": [
{
"date": "2026-05-15T12:07:48.313135Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "AI Gateway"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "BIG-IP"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "BIG-IP APM"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "BIG-IP Advanced WAF/ASM"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "BIG-IP DNS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": "BIG-IP Next CNF"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8"
}
}
],
"category": "product_name",
"name": "BIG-IP Next SPK"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-9"
}
}
],
"category": "product_name",
"name": "BIG-IP Next for Kubernetes"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-10"
}
}
],
"category": "product_name",
"name": "BIG-IP PEM"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-11"
}
}
],
"category": "product_name",
"name": "BIG-IP SSL Orchestrator"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-12"
}
}
],
"category": "product_name",
"name": "BIG-IP tenants on BX110 blades on VELOS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-13"
}
}
],
"category": "product_name",
"name": "BIG-IP tenants on BX520 blades on VELOS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-14"
}
}
],
"category": "product_name",
"name": "BIG-IP tenants on all other rSeries systems"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-15"
}
}
],
"category": "product_name",
"name": "BIG-IP tenants on r10000 rSeries"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-16"
}
}
],
"category": "product_name",
"name": "BIG-IP tenants on r12000 rSeries"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-17"
}
}
],
"category": "product_name",
"name": "BIG-IP tenants on r5000 rSeries"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-18"
}
}
],
"category": "product_name",
"name": "BIG-IQ"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-19"
}
}
],
"category": "product_name",
"name": "BIG-IQ Centralized Management"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-20"
}
}
],
"category": "product_name",
"name": "Distributed Cloud (all services)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-21"
}
}
],
"category": "product_name",
"name": "NGINX (all products)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-22"
}
}
],
"category": "product_name",
"name": "OS-A"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-23"
}
}
],
"category": "product_name",
"name": "OS-C"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-24"
}
}
],
"category": "product_name",
"name": "SSL Orchestrator"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-25"
}
}
],
"category": "product_name",
"name": "Silverline (all services)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-26"
}
}
],
"category": "product_name",
"name": "Traffix SDC"
}
],
"category": "vendor",
"name": "F5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-24464",
"cwe": {
"id": "CWE-35",
"name": "Path Traversal: \u0027.../...//\u0027"
},
"notes": [
{
"category": "other",
"text": "Path Traversal: \u0027.../...//\u0027",
"title": "CWE-35"
},
{
"category": "description",
"text": "A directory traversal vulnerability in an undisclosed iControl REST endpoint in Appliance mode may allow an authenticated administrator to bypass security boundaries and delete files.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-24464 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24464.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-24464"
},
{
"cve": "CVE-2026-28758",
"cwe": {
"id": "CWE-312",
"name": "Cleartext Storage of Sensitive Information"
},
"notes": [
{
"category": "other",
"text": "Cleartext Storage of Sensitive Information",
"title": "CWE-312"
},
{
"category": "description",
"text": "A vulnerability in BIG-IP DNS\u0027s gtm_add and bigip_add iControl REST commands exposes the ssh-password parameter in cleartext within responses and audit logs, risking sensitive information disclosure to highly privileged attackers.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-28758 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28758.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-28758"
},
{
"cve": "CVE-2026-32643",
"cwe": {
"id": "CWE-250",
"name": "Execution with Unnecessary Privileges"
},
"notes": [
{
"category": "other",
"text": "Execution with Unnecessary Privileges",
"title": "CWE-250"
},
{
"category": "description",
"text": "A vulnerability in BIG-IP and BIG-IQ systems allows a highly privileged, authenticated attacker with at least the Certificate Manager role to modify configuration objects and execute arbitrary commands, excluding versions past End of Technical Support.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-32643 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-32643.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-32643"
},
{
"cve": "CVE-2026-32673",
"cwe": {
"id": "CWE-250",
"name": "Execution with Unnecessary Privileges"
},
"notes": [
{
"category": "other",
"text": "Execution with Unnecessary Privileges",
"title": "CWE-250"
},
{
"category": "description",
"text": "A vulnerability in BIG-IP scripted monitors allows authenticated users with Resource Administrator or Administrator roles to execute arbitrary system commands with elevated privileges, potentially crossing security boundaries in appliance mode.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-32673 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-32673.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-32673"
},
{
"cve": "CVE-2026-34176",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "description",
"text": "An authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint in Appliance mode, potentially allowing an attacker to cross security boundaries.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-34176 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-34176.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-34176"
},
{
"cve": "CVE-2026-35062",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"notes": [
{
"category": "other",
"text": "Incorrect Privilege Assignment",
"title": "CWE-266"
},
{
"category": "description",
"text": "An authenticated iControl SOAP user may be able to access or obtain information from other accounts, with versions past End of Technical Support not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-35062 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-35062.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-35062"
},
{
"cve": "CVE-2026-39455",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"notes": [
{
"category": "other",
"text": "Missing Release of Resource after Effective Lifetime",
"title": "CWE-772"
},
{
"category": "description",
"text": "Configuring the BIG-IP Configuration utility to use LDAP authentication can cause the httpd process to exhaust available file descriptors due to undisclosed traffic, with unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-39455 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-39455.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-39455"
},
{
"cve": "CVE-2026-39458",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"notes": [
{
"category": "other",
"text": "Access of Uninitialized Pointer",
"title": "CWE-824"
},
{
"category": "description",
"text": "Enabling a BIG-IP DNS profile with DNS cache on a virtual server can cause the Traffic Management Microkernel (TMM) to terminate due to undisclosed traffic, with unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-39458 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-39458.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-39458"
},
{
"cve": "CVE-2026-39459",
"cwe": {
"id": "CWE-272",
"name": "Least Privilege Violation"
},
"notes": [
{
"category": "other",
"text": "Least Privilege Violation",
"title": "CWE-272"
},
{
"category": "description",
"text": "A vulnerability in iControl REST and TMOS Shell (tmsh) allows a highly privileged, authenticated attacker with at least Manager role to create configuration objects that enable execution of arbitrary commands.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-39459 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-39459.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-39459"
},
{
"cve": "CVE-2026-40060",
"cwe": {
"id": "CWE-252",
"name": "Unchecked Return Value"
},
"notes": [
{
"category": "other",
"text": "Unchecked Return Value",
"title": "CWE-252"
},
{
"category": "description",
"text": "Certain undisclosed requests can cause the bd process to terminate when a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, with unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40060 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40060.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-40060"
},
{
"cve": "CVE-2026-40061",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"title": "CWE-77"
},
{
"category": "description",
"text": "A vulnerability in BIG-IP DNS allows authenticated Resource Administrator or Administrator users to execute arbitrary system commands with elevated privileges, potentially crossing security boundaries in Appliance mode.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40061 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40061.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-40061"
},
{
"cve": "CVE-2026-40067",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "other",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "description",
"text": "Configuring a BIG-IP APM access policy on a virtual server can cause the apmd process to terminate due to undisclosed traffic, with unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40067 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40067.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-40067"
},
{
"cve": "CVE-2026-40423",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Configuring a SIP profile on a virtual server can cause the Traffic Management Microkernel (TMM) to terminate due to undisclosed traffic, with issues noted in software versions beyond End of Technical Support (EoTS).",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40423 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40423.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-40423"
},
{
"cve": "CVE-2026-40435",
"cwe": {
"id": "CWE-420",
"name": "Unprotected Alternate Channel"
},
"notes": [
{
"category": "other",
"text": "Unprotected Alternate Channel",
"title": "CWE-420"
},
{
"category": "description",
"text": "IP-based access restrictions configured for httpd do not apply to all endpoints, potentially allowing connections from blocked IP addresses, except in versions that have reached End of Technical Support.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40435 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40435.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-40435"
},
{
"cve": "CVE-2026-40462",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "other",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
},
{
"category": "description",
"text": "Incorrect permission assignment vulnerabilities in iControl REST and TMOS Shell (tmsh) undisclosed commands may allow authenticated attackers to access sensitive information.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40462 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40462.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-40462"
},
{
"cve": "CVE-2026-40618",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"notes": [
{
"category": "other",
"text": "Incorrect Calculation of Buffer Size",
"title": "CWE-131"
},
{
"category": "description",
"text": "Configuring an SSL profile on BIG-IP Virtual Edition without Intel QAT or on hardware with crypto.hwacceleration disabled can cause the Traffic Management Microkernel (TMM) to terminate when processing certain undisclosed traffic.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40618 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40618.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-40618"
},
{
"cve": "CVE-2026-40629",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Configuring SSL profiles on a virtual server can cause the server to stop processing new client connections when handling undisclosed traffic, with versions beyond End of Technical Support not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40629 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40629.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-40629"
},
{
"cve": "CVE-2026-40631",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"notes": [
{
"category": "other",
"text": "Files or Directories Accessible to External Parties",
"title": "CWE-552"
},
{
"category": "description",
"text": "An authenticated attacker with Resource Administrator or Administrator roles can exploit iControl SOAP to modify configuration objects and escalate privileges, with unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40631 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40631.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-40631"
},
{
"cve": "CVE-2026-40698",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"title": "CWE-77"
},
{
"category": "description",
"text": "A vulnerability in F5 BIG-IP and BIG-IQ systems allows a highly privileged, authenticated attacker with Resource Administrator role to create SNMP configuration objects via iControl REST or TMOS shell, resulting in privilege escalation.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40698 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40698.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-40698"
},
{
"cve": "CVE-2026-40699",
"cwe": {
"id": "CWE-643",
"name": "Improper Neutralization of Data within XPath Expressions (\u0027XPath Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Data within XPath Expressions (\u0027XPath Injection\u0027)",
"title": "CWE-643"
},
{
"category": "description",
"text": "A vulnerability in undisclosed pages of the Configuration utility may allow a low-privileged authenticated attacker to access sensitive information, with unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40699 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40699.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-40699"
},
{
"cve": "CVE-2026-40703",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"notes": [
{
"category": "other",
"text": "Cross-Site Request Forgery (CSRF)",
"title": "CWE-352"
},
{
"category": "description",
"text": "A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility, with versions that have reached End of Technical Support (EoTS) not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40703 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40703.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-40703"
},
{
"cve": "CVE-2026-41217",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "other",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
},
{
"category": "description",
"text": "A vulnerability in an undisclosed BIG-IP TMOS Shell command allows authenticated users with resource administrator or administrator roles to execute arbitrary system commands with elevated privileges, potentially crossing security boundaries in Appliance mode.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41217 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41217.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-41217"
},
{
"cve": "CVE-2026-41218",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "Configuring BIG-IP PEM iRules with certain commands on a virtual server can cause the Traffic Management Microkernel (TMM) to terminate, with unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41218 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41218.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-41218"
},
{
"cve": "CVE-2026-41219",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"notes": [
{
"category": "other",
"text": "Insertion of Sensitive Information into Log File",
"title": "CWE-532"
},
{
"category": "description",
"text": "An improper sanitization vulnerability in the BIG-IP QKView utility allows low-privileged attackers to read sensitive information from QKView files, with unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41219 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41219.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-41219"
},
{
"cve": "CVE-2026-41225",
"cwe": {
"id": "CWE-648",
"name": "Incorrect Use of Privileged APIs"
},
"notes": [
{
"category": "other",
"text": "Incorrect Use of Privileged APIs",
"title": "CWE-648"
},
{
"category": "description",
"text": "A vulnerability in iControl REST allows a highly privileged, authenticated attacker with at least Manager role to create configuration objects that enable arbitrary command execution.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41225 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41225.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-41225"
},
{
"cve": "CVE-2026-41227",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Certain undisclosed traffic on an HTTP/2 virtual server with Layer 7 DoS Protection can increase memory usage and cause the Traffic Management Microkernel (TMM) process to terminate.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41227 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41227.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-41227"
},
{
"cve": "CVE-2026-41953",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"title": "CWE-77"
},
{
"category": "description",
"text": "A vulnerability in BIG-IP systems enables a highly privileged, authenticated attacker with at least Resource Administrator role to modify configuration objects, resulting in privilege escalation.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41953 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41953.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-41953"
},
{
"cve": "CVE-2026-41954",
"notes": [
{
"category": "description",
"text": "A sensitive information disclosure vulnerability in an undisclosed iControl REST endpoint and TMOS Shell (tmsh) command may allow an authenticated attacker with resource administrator privileges to access sensitive information.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41954 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41954.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-41954"
},
{
"cve": "CVE-2026-41956",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "other",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "description",
"text": "Configuring a classification profile on a UDP virtual server can cause the Traffic Management Microkernel (TMM) to terminate upon receiving certain undisclosed requests, with unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41956 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41956.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-41956"
},
{
"cve": "CVE-2026-41957",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "description",
"text": "An authenticated remote code execution vulnerability exists in the BIG-IP and BIG-IQ Configuration utility through undisclosed vectors, excluding software versions that have reached End of Technical Support.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41957 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41957.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-41957"
},
{
"cve": "CVE-2026-41959",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "other",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
},
{
"category": "description",
"text": "Incorrect permission assignment vulnerabilities in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and BIG-IP iControl REST may allow authenticated attackers to view network status of destination systems.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41959 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41959.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-41959"
},
{
"cve": "CVE-2026-42058",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "other",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
},
{
"category": "description",
"text": "An authenticated attacker can exploit undisclosed requests to BIG-IP iControl REST to leak local user account names, with unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42058 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42058.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-42058"
},
{
"cve": "CVE-2026-42063",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"notes": [
{
"category": "other",
"text": "Files or Directories Accessible to External Parties",
"title": "CWE-552"
},
{
"category": "description",
"text": "A vulnerability in iControl SOAP allows authenticated users with Resource Administrator or Administrator roles to download sensitive files, with unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42063 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42063.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-42063"
},
{
"cve": "CVE-2026-42406",
"cwe": {
"id": "CWE-267",
"name": "Privilege Defined With Unsafe Actions"
},
"notes": [
{
"category": "other",
"text": "Privilege Defined With Unsafe Actions",
"title": "CWE-267"
},
{
"category": "description",
"text": "A vulnerability in BIG-IP and BIG-IQ systems allows a highly privileged, authenticated attacker with the Certificate Manager role to modify configuration objects and execute arbitrary commands, excluding versions past End of Technical Support.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42406 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42406.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-42406"
},
{
"cve": "CVE-2026-42408",
"cwe": {
"id": "CWE-312",
"name": "Cleartext Storage of Sensitive Information"
},
"notes": [
{
"category": "other",
"text": "Cleartext Storage of Sensitive Information",
"title": "CWE-312"
},
{
"category": "description",
"text": "A vulnerability in an undisclosed TMOS Shell (tmsh) command in BIG-IP DNS may allow a highly privileged authenticated attacker to view sensitive information.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42408 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42408.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-42408"
},
{
"cve": "CVE-2026-42409",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "description",
"text": "Configuring an HTTP/2 profile with an iRule using HTTP::redirect or HTTP::respond on a virtual server can cause the Traffic Management Microkernel (TMM) process to terminate due to certain request handling issues.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42409 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42409.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-42409"
},
{
"cve": "CVE-2026-42780",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "description",
"text": "A directory traversal vulnerability in BIG-IP SSL Orchestrator allows an authenticated high-privilege attacker to overwrite, delete, or corrupt arbitrary local files, affecting supported software versions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42780 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42780.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-42780"
},
{
"cve": "CVE-2026-42781",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "other",
"text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"title": "CWE-835"
},
{
"category": "description",
"text": "Configuring embedded Packet Velocity Acceleration (ePVA) can increase resource utilization in ePVA and Traffic Management Microkernel (TMM) due to undisclosed local ethernet traffic, with unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42781 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42781.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-42781"
},
{
"cve": "CVE-2026-42919",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "other",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "description",
"text": "A vulnerability in BIG-IP systems allows an authenticated attacker with administrative access to escalate privileges and cross security boundaries, with unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42919 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42919.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-42919"
},
{
"cve": "CVE-2026-42920",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "other",
"text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"title": "CWE-835"
},
{
"category": "description",
"text": "Configuring a Client SSL profile with Allow Dynamic Record Sizing on a UDP virtual server can cause the Traffic Management Microkernel (TMM) to terminate due to undisclosed traffic issues.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42920 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42920.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-42920"
},
{
"cve": "CVE-2026-42924",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "description",
"text": "An authenticated attacker with Resource Administrator or Administrator roles can exploit iControl SOAP to create SNMP configuration objects, leading to privilege escalation.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42924 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42924.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-42924"
},
{
"cve": "CVE-2026-42930",
"cwe": {
"id": "CWE-35",
"name": "Path Traversal: \u0027.../...//\u0027"
},
"notes": [
{
"category": "other",
"text": "Path Traversal: \u0027.../...//\u0027",
"title": "CWE-35"
},
{
"category": "description",
"text": "An authenticated attacker with Administrator privileges may bypass Appliance mode restrictions on a BIG-IP system, including some unsupported software versions not evaluated.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42930 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42930.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-42930"
},
{
"cve": "CVE-2026-42937",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "other",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
},
{
"category": "description",
"text": "Incorrect permission assignment vulnerabilities in BIG-IP and BIG-IQ TMOS Shell arp and ndp commands, as well as in BIG-IP iControl REST, may allow an authenticated attacker to access adjacent network information.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42937 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42937.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26"
]
}
],
"title": "CVE-2026-42937"
}
]
}
WID-SEC-W-2026-1532
Vulnerability from csaf_certbund - Published: 2026-05-14 22:00 - Updated: 2026-05-14 22:00Summary
F5 BIG-IP Produkte: Mehrere Schwachstellen
Severity
Mittel
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: BIG-IP ist eine Netzwerk Appliance auf der die meisten F5 Produkte laufen.
Angriff: Ein Angreifer kann mehrere Schwachstellen in F5 BIG-IP ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
Betroffene Betriebssysteme: - Sonstiges
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
F5 BIG-IP SSL Orchestrator
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ssl_orchestrator
|
SSL Orchestrator | |
|
F5 BIG-IP DNS
F5 / BIG-IP
|
cpe:/a:f5:big-ip:dns
|
DNS | |
|
F5 BIG-IP APM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:apm
|
APM | |
|
F5 BIG-IP PEM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:pem
|
PEM | |
|
F5 BIG-IP DDoS Hybrid Defender
F5 / BIG-IP
|
cpe:/a:f5:big-ip:ddos_hybrid_defender
|
DDoS Hybrid Defender | |
|
F5 BIG-IP Advanced WAF/ASM
F5 / BIG-IP
|
cpe:/a:f5:big-ip:advanced_wafasm
|
Advanced WAF/ASM | |
|
F5 BIG-IP Next SPK
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_spk
|
Next SPK | |
|
F5 BIG-IP Next for Kubernetes
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_for_kubernetes
|
Next for Kubernetes | |
|
F5 BIG-IP Next CNF
F5 / BIG-IP
|
cpe:/a:f5:big-ip:next_cnf
|
Next CNF | |
|
F5 BIG-IP
F5 / BIG-IP
|
cpe:/a:f5:big-ip:-
|
— |
References
60 references
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "BIG-IP ist eine Netzwerk Appliance auf der die meisten F5 Produkte laufen.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in F5 BIG-IP ausnutzen, um beliebigen Programmcode auszuf\u00fchren, erweiterte Berechtigungen zu erlangen, Sicherheitsma\u00dfnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-1532 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1532.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-1532 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1532"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000149743"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000156734"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000157895"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000158038"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160862"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160863"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160874"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160876"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160903"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160911"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160916"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160945"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160971"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160972"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000161018"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160981"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160979"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160973"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000161040"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000161022"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000161107"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K32950402"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160975"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160857"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000158978"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000158070"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000156761"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000158082"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000156581"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000156604"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160926"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160901"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000158971"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000159034"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000157981"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000158979"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160875"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K35544022"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000161023"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000161056"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160788"
},
{
"category": "external",
"summary": "F5 Security Advisory vom 2026-05-13",
"url": "https://my.f5.com/manage/s/article/K000160727"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-29965"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-29969"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-29971"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-29972"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-29982"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-29984"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-29987"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-29998"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-29999"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-30003"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-30004"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-30005"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-29973"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-29975"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-29976"
},
{
"category": "external",
"summary": "EUVD Security Advisory vom 2026-05-13",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-29991"
}
],
"source_lang": "en-US",
"title": "F5 BIG-IP Produkte: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-05-14T22:00:00.000+00:00",
"generator": {
"date": "2026-05-15T09:54:07.909+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.5.0"
}
},
"id": "WID-SEC-W-2026-1532",
"initial_release_date": "2026-05-14T22:00:00.000+00:00",
"revision_history": [
{
"date": "2026-05-14T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "F5 BIG-IP",
"product": {
"name": "F5 BIG-IP",
"product_id": "T054135",
"product_identification_helper": {
"cpe": "cpe:/a:f5:big-ip:-"
}
}
},
{
"category": "product_version",
"name": "Next CNF",
"product": {
"name": "F5 BIG-IP Next CNF",
"product_id": "T054136",
"product_identification_helper": {
"cpe": "cpe:/a:f5:big-ip:next_cnf"
}
}
},
{
"category": "product_version",
"name": "Next for Kubernetes",
"product": {
"name": "F5 BIG-IP Next for Kubernetes",
"product_id": "T054137",
"product_identification_helper": {
"cpe": "cpe:/a:f5:big-ip:next_for_kubernetes"
}
}
},
{
"category": "product_version",
"name": "Next SPK",
"product": {
"name": "F5 BIG-IP Next SPK",
"product_id": "T054138",
"product_identification_helper": {
"cpe": "cpe:/a:f5:big-ip:next_spk"
}
}
},
{
"category": "product_version",
"name": "Advanced WAF/ASM",
"product": {
"name": "F5 BIG-IP Advanced WAF/ASM",
"product_id": "T054139",
"product_identification_helper": {
"cpe": "cpe:/a:f5:big-ip:advanced_wafasm"
}
}
},
{
"category": "product_version",
"name": "DDoS Hybrid Defender",
"product": {
"name": "F5 BIG-IP DDoS Hybrid Defender",
"product_id": "T054140",
"product_identification_helper": {
"cpe": "cpe:/a:f5:big-ip:ddos_hybrid_defender"
}
}
},
{
"category": "product_version",
"name": "PEM",
"product": {
"name": "F5 BIG-IP PEM",
"product_id": "T054141",
"product_identification_helper": {
"cpe": "cpe:/a:f5:big-ip:pem"
}
}
},
{
"category": "product_version",
"name": "APM",
"product": {
"name": "F5 BIG-IP APM",
"product_id": "T054142",
"product_identification_helper": {
"cpe": "cpe:/a:f5:big-ip:apm"
}
}
},
{
"category": "product_version",
"name": "DNS",
"product": {
"name": "F5 BIG-IP DNS",
"product_id": "T054143",
"product_identification_helper": {
"cpe": "cpe:/a:f5:big-ip:dns"
}
}
},
{
"category": "product_version",
"name": "SSL Orchestrator",
"product": {
"name": "F5 BIG-IP SSL Orchestrator",
"product_id": "T054144",
"product_identification_helper": {
"cpe": "cpe:/a:f5:big-ip:ssl_orchestrator"
}
}
}
],
"category": "product_name",
"name": "BIG-IP"
}
],
"category": "vendor",
"name": "F5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-24464",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-24464"
},
{
"cve": "CVE-2026-28758",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-28758"
},
{
"cve": "CVE-2026-32643",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-32643"
},
{
"cve": "CVE-2026-32673",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-32673"
},
{
"cve": "CVE-2026-34176",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-34176"
},
{
"cve": "CVE-2026-35062",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-35062"
},
{
"cve": "CVE-2026-39455",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-39455"
},
{
"cve": "CVE-2026-39458",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-39458"
},
{
"cve": "CVE-2026-39459",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-39459"
},
{
"cve": "CVE-2026-40060",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-40060"
},
{
"cve": "CVE-2026-40061",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-40061"
},
{
"cve": "CVE-2026-40067",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-40067"
},
{
"cve": "CVE-2026-40423",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-40423"
},
{
"cve": "CVE-2026-40435",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-40435"
},
{
"cve": "CVE-2026-40462",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-40462"
},
{
"cve": "CVE-2026-40618",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-40618"
},
{
"cve": "CVE-2026-40629",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-40629"
},
{
"cve": "CVE-2026-40631",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-40631"
},
{
"cve": "CVE-2026-40698",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-40698"
},
{
"cve": "CVE-2026-40699",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-40699"
},
{
"cve": "CVE-2026-40703",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-40703"
},
{
"cve": "CVE-2026-41217",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-41217"
},
{
"cve": "CVE-2026-41218",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-41218"
},
{
"cve": "CVE-2026-41219",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-41219"
},
{
"cve": "CVE-2026-41225",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-41225"
},
{
"cve": "CVE-2026-41227",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-41227"
},
{
"cve": "CVE-2026-41953",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-41953"
},
{
"cve": "CVE-2026-41954",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-41954"
},
{
"cve": "CVE-2026-41956",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-41956"
},
{
"cve": "CVE-2026-41957",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-41957"
},
{
"cve": "CVE-2026-41959",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-41959"
},
{
"cve": "CVE-2026-42058",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-42058"
},
{
"cve": "CVE-2026-42063",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-42063"
},
{
"cve": "CVE-2026-42406",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-42406"
},
{
"cve": "CVE-2026-42408",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-42408"
},
{
"cve": "CVE-2026-42409",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-42409"
},
{
"cve": "CVE-2026-42780",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-42780"
},
{
"cve": "CVE-2026-42781",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-42781"
},
{
"cve": "CVE-2026-42919",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-42919"
},
{
"cve": "CVE-2026-42920",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-42920"
},
{
"cve": "CVE-2026-42924",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-42924"
},
{
"cve": "CVE-2026-42930",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-42930"
},
{
"cve": "CVE-2026-42937",
"product_status": {
"known_affected": [
"T054144",
"T054143",
"T054142",
"T054141",
"T054140",
"T054139",
"T054138",
"T054137",
"T054136",
"T054135"
]
},
"release_date": "2026-05-14T22:00:00.000+00:00",
"title": "CVE-2026-42937"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…