F5: exploited vulnerabilities
- 8exploited vulnerabilities
- 4used by ransomware
- Sep 22, 2026latest one added
- BIG-IP 3
- BIG-IP Configuration Utility 2
- BIG-IP APM 1
- BIG-IP Traffic Management Microkernel 1
- BIG-IP and BIG-IQ Centralized Management 1
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 22, 2026 | Heap-based Buffer Overflow | BIG-IP APM | Critical 9.3 | 25% |
| Mar 27, 2026 | Stack-Based Buffer Overflow | BIG-IP | Critical 9.3 | 2.3% |
| Oct 31, 2023 | SQL Injection | BIG-IP Configuration Utility | High 8.8 | 4.5% |
| Oct 31, 2023 | Authentication Bypass | BIG-IP Configuration Utility | Critical 9.8 | 97% |
| May 10, 2022 | Missing Authentication | BIG-IP | Critical 9.8 | >99.9% |
| Jan 18, 2022 | Buffer Overflow | BIG-IP Traffic Management Microkernel | Critical 9.8 | 62% |
| Nov 3, 2021 | iControl REST Remote Code Execution | BIG-IP and BIG-IQ Centralized Management | Critical 9.8 | 99.9% |
| Nov 3, 2021 | Traffic Management User Interface (TMUI) Remote Code Execution | BIG-IP | Critical 9.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.