F5 Vulnerabilities and Affected Products

Products

BIG-IP257 vulnerabilities
NGINX Plus31 vulnerabilities
NGINX Open Source29 vulnerabilities
BIG-IP Next CNF26 vulnerabilities
BIG-IP Next SPK23 vulnerabilities
BIG-IQ19 vulnerabilities
BIG-IP Next for Kubernetes13 vulnerabilities
BIG-IP APM12 vulnerabilities
F5OS - Appliance12 vulnerabilities
BIG-IP Edge Client11 vulnerabilities
F5OS - Chassis10 vulnerabilities
BIG-IP Next Central Manager9 vulnerabilities
BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)8 vulnerabilities
BIG-IQ Centralized Management7 vulnerabilities
big-ip_next_central_manager6 vulnerabilities
nginx6 vulnerabilities
NGINX Ingress Controller5 vulnerabilities
NGINX Instance Manager5 vulnerabilities
nginx_plus5 vulnerabilities
BIG-IP Guided Configuration (GC)4 vulnerabilities
BIG-IP Next4 vulnerabilities
F5OS-A4 vulnerabilities
BIG-IP Advanced WAF & ASM3 vulnerabilities
BIG-IP AFM3 vulnerabilities
BIG-IP APM Clients3 vulnerabilities

F5 vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-20730LOW	BIG-IP Edge Client for Windows vulnerability A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated CWE-200Feb 4, 2026	CVSS2.0v4.0	EPSS0.1%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-48500HIGH	BIG-IP APM VPN web client for macOS vulnerability A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. CWE-353Aug 13, 2025	CVSS7.0v4.0	EPSS0.113%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-28883HIGH	BIG-IP APM browser network access VPN client vulnerability An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to bypass F5 endpoint inspection. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. CWE-346May 8, 2024	CVSS7.4v3.1	EPSS0.205%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-43611HIGH	BIG-IP Edge Client for macOS vulnerability The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated CWE-347Oct 10, 2023	CVSS7.8v3.1	EPSS0.146%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-5450HIGH	BIG-IP Edge Client for macOS vulnerability An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. CWE-345Oct 10, 2023	CVSS7.3v3.1	EPSS0.14%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-43125MEDIUM	BIG-IP APM Clients TunnelCrack vulnerability BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated CWE-319Sep 27, 2023	CVSS6.8v3.1	EPSS0.237%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-43124MEDIUM	BIG-IP APM Clients TunnelCrack vulnerability BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated CWE-319Sep 27, 2023	CVSS5.3v3.1	EPSS0.154%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-38418HIGH	BIG-IP Edge Client for macOS vulnerability The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. CWE-347Aug 2, 2023	CVSS7.8v3.1	EPSS0.145%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-36858HIGH	BIG-IP Edge Client for Windows and macOS vulnerability An insufficient verification of data vulnerability exists in BIG-IP Edge Client for Windows and macOS that may allow an attacker to modify its configured server list. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. CWE-345Aug 2, 2023	CVSS7.1v3.1	EPSS0.135%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-24461HIGH	BIG-IP Edge Client for Windows and macOS vulnerability An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. CWE-295May 3, 2023	CVSS7.4v3.1	EPSS0.286%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-22372MEDIUM	BIG-IP Edge Client for Windows and Mac OS vulnerability In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. CWE-924May 3, 2023	CVSS5.9v3.1	EPSS0.219%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX