Vendor
F5
1,064 known vulnerabilities in products by F5, 14 of them actively exploited (CISA KEV).
Key figures
1,064
Vulnerabilities
14
Actively exploited (KEV)
5
Used by ransomware
87
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2023-46747 | BIG-IP Configuration utility unauthenticated remote code execution vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2022-1388 | F5 BIG-IP Missing Authentication Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2020-5902 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-22986 | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-40438 | mod_proxy SSRF In CISA KEVRansomware | 9.0 | |
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2026-94127 | BIG-IP APM OAuth vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2014-6271 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2014-7169 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2021-22991 | F5 BIG-IP Traffic Management Microkernel Buffer Overflow In CISA KEV | 9.8 | |
| Critical | CVE-2025-53521 | BigIP APM Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2023-46748 | BIG-IP Configuration utility authenticated SQL injection vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2018-14634 | Linux Kernel Integer Overflow Vulnerability In CISA KEV | 7.8 | |
| Critical | CVE-2014-0196 | Linux Kernel Race Condition Vulnerability In CISA KEV | 5.5 | |
| High | CVE-2026-27654 | NGINX ngx_http_dav_module vulnerability | 8.2 | |
| Critical | CVE-2026-42055 | NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability | 8.1 | |
| Critical | CVE-2026-9256 | NGINX ngx_http_rewrite_module vulnerability | 8.1 | |
| High | CVE-2025-31644 | Appliance mode BIG-IP iControl REST and tmsh vulnerability | 8.7 | |
| Critical | CVE-2009-3555 | OpenSSL: security vulnerability | 9.8 | |
| Critical | CVE-2021-22992 | BIG-IP Advanced WAF and BIG-IP ASM: Buffer Overflow | 9.8 | |
| Critical | CVE-2017-18017 | SUSE Linux Enterprise Debuginfo: Use-After-Free | 9.8 | |
| Critical | CVE-2026-42945 | NGINX ngx_http_rewrite_module vulnerability | 8.1 | |
| High | CVE-2022-41622 | iControl SOAP vulnerability | 8.8 | |
| High | CVE-2022-41800 | Appliance mode iControl REST vulnerability | 8.7 | |
| Critical | CVE-2021-22987 | BIG-IP Appliance Mode: security vulnerability | 9.9 |
News
- F5 rushes out emergency NGINX patches for three critical flawscsoonline,
- F5 fixes actively exploited zero-day flaw in BIG-IP APMcsoonline,
- F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Serversthehackernews,
- Vulnérabilité dans F5 BIG-IP (23 septembre 2026)cert-fr,
- Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gatewayscsoonline,
- 17 old software bugs that took way too long to squashcsoonline,