Vulnerabilidades de F5

CVEs publicadas que afetam produtos de F5: 160 registro(s), com severidade, exploração e correções.

BIG-IP 88 Big-ip Access Policy Manager 79 Big-ip Application Security Manager 78 Big-ip Advanced Firewall Manager 71 Big-ip Advanced Web Application Firewall 71 Big-ip Policy Enforcement Manager 71 Big-ip Local Traffic Manager 70 Big-ip Analytics 70 Big-ip Application Acceleration Manager 70 Big-ip Global Traffic Manager 70 Big-ip Link Controller 70 Big-ip Domain Name System 69 Big-ip Webaccelerator 66 Big-ip Ssl Orchestrator 65 Big-ip Ddos Hybrid Defender 65 Big-ip Fraud Protection Service 65 Big-ip Edge Gateway 63 Big-ip Container Ingress Services 61 Big-ip Application Visibility And Reporting 61 Big-ip Websafe 61 Big-ip Carrier-grade Nat 61 Big-ip Automation Toolchain 60 Nginx Open Source 26 Nginx Plus 25 Nginx Ingress Controller 22 Nginx Gateway Fabric 21 Big-ip Next Cloud-native Network Functions 16 BIG-IP Next CNF 16 Nginx Instance Manager 13 Big-ip Next For Kubernetes 12 Waf 12 BIG-IP Next SPK 12 Big-ip Next Service Proxy For Kubernetes 12 Big-iq Centralized Management 11 BIG-IQ 10 Dos 8 F5OS - Appliance 6 NGINX JavaScript 6 F5os-a 6 F5OS - Chassis 5

Somente exploradas (KEV) →

CVE-2026-42063 Média · 4.9 CWE-552 13/05/2026

iControl SOAP vulnerability

A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-42058 Média · 4.3 CWE-732 13/05/2026

BIG-IP iControl REST vulnerability

An authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an information leak of BIG-IP local user account names. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-41959 Média · 6.5 CWE-732 13/05/2026

iControl and tmsh REST vulnerability

Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view the network status of destination systems. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-41957 Alta · 8.8 CWE-502 13/05/2026

BIG-IP and BIG-IQ Configuration utility vulnerability

An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-41956 Alta · 7.5 CWE-121 13/05/2026

BIG-IP TMM Vulnerability

When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-41954 Média · 4.9 CWE-200 13/05/2026

iControl REST and tmsh vulnerability

Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-41953 Alta · 8.7 CWE-77 13/05/2026

BIG-IP Privilege Escalation vulnerability

A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-41227 Alta · 7.5 CWE-770 13/05/2026

BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability

On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-41225 Crítica · 9.1 CWE-648 13/05/2026

iControl REST vulnerability

A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-41219 Média · 6.5 CWE-532 13/05/2026

BIG-IP QKView vulnerability

An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVE-2026-41218 Alta · 7.5 CWE-416 13/05/2026

BIG-IP PEM iRules vulnerability

When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-41217 Alta · 7.9 CWE-732 13/05/2026

BIG-IP tmsh vulnerability

A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40703 Média · 5.4 CWE-352 13/05/2026

BIG-IP Configuration utility CSRF vulnerability

A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40701 Média · 4.8 CWE-416 13/05/2026

NGINX ngx_http_ssl_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40699 Média · 6.5 CWE-643 13/05/2026

BIG-IP Configuration utility vulnerability

A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40698 Alta · 8.7 CWE-77 13/05/2026

iControl REST and TMSH vulnerability

A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration objects through iControl REST or the TMOS shell (tmsh) resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40631 Alta · 8.7 CWE-552 13/05/2026

BIG-IP iControl SOAP vulnerability

An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40629 Alta · 7.5 CWE-770 13/05/2026

BIG-IP SSL/TLS vulnerability

When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40618 Alta · 7.5 CWE-131 13/05/2026

BIG-IP SSL/TLS vulnerability

When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40462 Média · 6.5 CWE-732 13/05/2026

iControl REST and tmsh vulnerability

Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40460 Média · 6.5 CWE-290 13/05/2026

NGINX ngx_quic_module vulnerability

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40435 Média · 5.3 CWE-420 13/05/2026

BIG-IP httpd access control vulnerability

When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40423 Alta · 7.5 CWE-770 13/05/2026

BIG-IP SIP profile vulnerability

When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40067 Alta · 7.5 CWE-120 13/05/2026

BIG-IP APM Vulnerability

When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-40061 Alta · 8.7 CWE-77 13/05/2026

iControl REST and tmsh vulnerability

When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.