[ Vendor · 20 CVEs ]
F5
CVEs affecting F5 published in the last 30 days, plus any F5 CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-96615 | 14 Oct 2026 | CVSS 6.5 | F5 NGINX Gateway FabricDescription NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated… | |
| CVE-2026-97205 | 14 Oct 2026 | CVSS 8.1 | F5 NGINX PlusNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain… | Fix |
| CVE-2026-97629 | 14 Oct 2026 | CVSS 6.5 | F5 NGINX PlusDescription When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key… | Fix |
| CVE-2026-95101 | 14 Oct 2026 | CVSS 5.3 | F5 NGINX PlusDescription NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on… | Fix |
| CVE-2026-91184 | 14 Oct 2026 | CVSS 8.8 | F5 NGINX Gateway FabricDescription NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced… | |
| CVE-2026-93479 | 14 Oct 2026 | CVSS 8.1 | F5 NGINX PlusA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format… | Fix |
| CVE-2026-94197 | 14 Oct 2026 | CVSS 7.5 | F5 NGINX Ingress ControllerAn authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the… | |
| CVE-2026-15176 | 14 Oct 2026 | CVSS 8.1 | F5 NGINX PlusA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a… | Fix |
| CVE-2026-104939 | 14 Oct 2026 | CVSS 7.5 | F5 NGINX Ingress ControllerDescription NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle… | |
| CVE-2026-101019 | 14 Oct 2026 | CVSS 6.5 | F5 NGINX JavaScriptDescription NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2… | |
| CVE-2026-101025 | 14 Oct 2026 | CVSS 5.3 | F5 NGINX JavaScriptDescription NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The… | |
| CVE-2026-94127 | 22 Sep 2026 | CVSS 9.8 | F5 BIG-IP APM Heap-based Buffer OverflowWhen a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution… | ExploitedFix |
| CVE-2025-53521 | 15 Oct 2025 | CVSS 9.8 | F5 BIG-IP Stack-Based Buffer OverflowWhen a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software… | Exploited |
| CVE-2023-46747 | 26 Oct 2023 | CVSS 9.8 | F5 BIG-IP Configuration Utility Authentication BypassUndisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the… | Exploited |
| CVE-2023-46748 | 26 Oct 2023 | CVSS 8.8 | F5 BIG-IP Configuration Utility SQL InjectionAn authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access… | Exploited |
| CVE-2022-1388 | 5 May 2022 | CVSS 9.8 | F5 BIG-IP Missing AuthenticationOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to… | Exploited |
| CVE-2021-22991 | 31 Mar 2021 | CVSS 9.8 | F5 BIG-IP Traffic Management Microkernel Buffer OverflowOn BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3… | Exploited |
| CVE-2021-22986 | 31 Mar 2021 | CVSS 9.8 | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code ExecutionOn BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd… | Exploited |
| CVE-2020-5902 | 1 Jul 2020 | CVSS 9.8 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code ExecutionIn BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface… | Exploited |
| CVE-2014-0196 | 7 May 2014 | CVSS 5.5 | Linux Kernel Race ConditionThe n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST"… | ExploitedFix |