BIG-IP
F5- Product type
- Other
- Catalog vulnerabilities
- 261
Severity across 116 analyzed records
en
Verify to analyze this security profile
As of 09/13/2026, within CyStack's analyzed data, BIG-IP has 3 security vulnerabilities published in the last 90 days. Of these, 2 are rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of BIG-IP and determine which vulnerabilities affect that version.
| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-66842BIG-IP and BIG-IQ Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Published09/02/2026 | SeverityHigh |
CVE-2026-63020BIG-IP Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Published09/02/2026 | SeverityLow |
CVE-2026-59762BIG-IP HTTP/2 vulnerability | Exploitation statusNot known exploited | FixYes | Published07/15/2026 | SeverityHigh |
CVE-2026-40423BIG-IP SIP profile vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-42930Appliance mode iControl REST vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-24464Appliance mode iControl REST vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-39458BIG-IP DNS Cache vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-41959iControl and tmsh REST vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-42406BIG-IP and BIG-IQ privilege escalation vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-42058BIG-IP iControl REST vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-32643BIG-IP and BIG-IQ privilege escalation vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-42937iControl REST and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-39455BIG-IP Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-32673BIG-IP scripted monitor vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-41217BIG-IP tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-34176Knowledge Appliance mode iControl REST vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-42063iControl SOAP vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-41225iControl REST vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-39459iControl REST and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-41953BIG-IP Privilege Escalation vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-40631BIG-IP iControl SOAP vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-40698iControl REST and TMSH vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-42924BIG-IP iControl SOAP vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-40060BIG-IP Advanced WAF and ASM vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-42409BIG-IP HTTP/2 vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-41227BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-40061iControl REST and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-35062iControl SOAP vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-40618BIG-IP SSL/TLS vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-41956BIG-IP TMM Vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-42920BIG-IP DTLS Vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-40629BIG-IP SSL/TLS vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-42919F5 BIG-IP Appliance Mode Vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-41218BIG-IP PEM iRules vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-42781BIG-IP FastL4 virtual server vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-41957BIG-IP and BIG-IQ Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-42408BIG-IP DNS tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-40067BIG-IP APM Vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-40699BIG-IP Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-34019BIG-IP BFD vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-42780BIG-IP SSL Orchestrator vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-41219BIG-IP QKView vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-40462iControl REST and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-28758BIG-IP iControl REST vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-41954iControl REST and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-40435BIG-IP httpd access control vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-40703BIG-IP Configuration utility CSRF vulnerability | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-2507BIG-IP TMM Vulnerability | Exploitation statusNot known exploited | FixYes | Published02/18/2026 | SeverityHigh |
CVE-2026-22548BIG-IP Advanced WAF and ASM vulnerability | Exploitation statusNot known exploited | FixYes | Published02/04/2026 | SeverityHigh |
CVE-2026-20732BIG-IP Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Published02/04/2026 | SeverityLow |
CVE-2025-61990TMM vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-61933BIG-IP APM cross-site scripting (XSS) vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityMedium |
CVE-2025-58071BIG-IP IPSec vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-61935BIG-IP Advanced WAF and ASM vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-54755BIG-IP Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityMedium |
CVE-2025-59483BIG-IP Configuration utility and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-61974BIG-IP SSL/TLS vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-59481BIG-IP iControl REST and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-61960BIG-IP APM portal access vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-54854BigIP APM Vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-61958BIG-IP TMSH vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-53521BigIP APM Vulnerability | Exploitation statusKEV | FixYes | Published10/15/2025 | SeverityCritical |
CVE-2025-58096BIG-IP TMM vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-54858BIG-IP Advanced WAF and ASM vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-53868BIG-IP SCP and SFTP vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-61951BIG-IP DTLS 1.2 Vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-53856TMM vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-54479BIG-IP PEM vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-41430BIG-IP SSL Orchestrator vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-61938BIG-IP Advanced WAF and ASM bd process vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-58424BIG-IP TMM vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityMedium |
CVE-2025-55036BIG-IP SSL Orchestrator vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-59781BIG-IP DNS cache vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-46706BIG-IP iRules vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-55669BIG-IP HTTP/2 vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-48008BIG-IP MPTCP vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-58153BIG-IP HSB vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-60016BIG-IP SSL/TLS vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-59478BIG-IP AFM DoS protection profile vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-58474BIG-IP Advanced WAF and ASM and NGINX App Protect DNS lookup vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityMedium |
CVE-2025-47148BIG-IP APM and SSL Orchestrator vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-59269BIG-IP Configuration utility XSS vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-59268BIG-IP Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityMedium |
CVE-2025-53474BIG-IP iRules vulnerability | Exploitation statusNot known exploited | FixYes | Published10/15/2025 | SeverityHigh |
CVE-2025-54500HTTP/2 Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Published08/13/2025 | SeverityMedium |
CVE-2025-48500BIG-IP APM VPN web client for macOS vulnerability | Exploitation statusNot known exploited | FixYes | Published08/13/2025 | SeverityHigh |
CVE-2025-46405BIG-IP APM vulnerability | Exploitation statusNot known exploited | FixYes | Published08/13/2025 | SeverityHigh |
CVE-2025-52585BIG-IP Client SSL profile vulnerability | Exploitation statusNot known exploited | FixYes | Published08/13/2025 | SeverityHigh |
CVE-2025-41431TMM Vulnerability | Exploitation statusNot known exploited | FixYes | Published05/07/2025 | SeverityHigh |
CVE-2025-31644Appliance mode BIG-IP iControl REST and tmsh vulnerability | Exploitation statusPublic exploit | FixYes | Published05/07/2025 | SeverityHigh |
CVE-2025-35995BIG-IP PEM vulnerability | Exploitation statusNot known exploited | FixYes | Published05/07/2025 | SeverityHigh |
CVE-2025-36525BIG-IP APM PingAccess Virtual Server Vulnerability | Exploitation statusNot known exploited | FixYes | Published05/07/2025 | SeverityHigh |
CVE-2025-36504BIG-IP HTTP/2 vulnerability | Exploitation statusNot known exploited | FixYes | Published05/07/2025 | SeverityHigh |
CVE-2025-41414BIG-IP HTTP/2 vulnerability | Exploitation statusNot known exploited | FixYes | Published05/07/2025 | SeverityHigh |
CVE-2025-41433BIG-IP SIP ALG profile vulnerability | Exploitation statusNot known exploited | FixYes | Published05/07/2025 | SeverityHigh |
CVE-2025-36557BIG-IP HTTP vulnerability | Exploitation statusNot known exploited | FixYes | Published05/07/2025 | SeverityHigh |
CVE-2025-41399SCTP Vulnerability | Exploitation statusNot known exploited | FixYes | Published05/07/2025 | SeverityHigh |
CVE-2025-20029BIG-IP iControl REST and tmsh vulnerability | Exploitation statusPublic exploit | FixYes | Published02/05/2025 | SeverityHigh |
CVE-2025-24320BIG-IP Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Published02/05/2025 | SeverityMedium |
CVE-2025-24497BIG-IP PEM vulnerability | Exploitation statusNot known exploited | FixYes | Published02/05/2025 | SeverityHigh |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan