CVE-2014-9326: F5 BIG-IP Access Policy Manager

Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days.

The automatic signature update functionality in the (1) Phone Home feature in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, GTM, and Link Controller 11.5.0 through 11.6.0, ASM 10.0.0 through 11.6.0, and PEM 11.3.0 through 11.6.0 and the (2) Call Home feature in ASM 10.0.0 through 11.6.0 and PEM 11.3.0 through 11.6.0 does not properly validate server SSL certificates, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Affected products

F5 BIG-IP Access Policy Manager: version 11.5.0 only; version 11.5.1 only; version 11.5.2 only; version 11.6.0 only
F5 BIG-IP Advanced Firewall Manager: version 11.5.0 only; version 11.5.1 only; version 11.5.2 only; version 11.6.0 only
F5 BIG-IP Analytics: version 11.5.0 only; version 11.5.1 only; version 11.5.2 only; version 11.6.0 only
F5 BIG-IP Application Acceleration Manager: version 11.5.0 only; version 11.5.1 only; version 11.5.2 only; version 11.6.0 only
F5 BIG-IP Application Security Manager: version 11.5.0 only; version 11.5.1 only; version 11.5.2 only; version 11.6.0 only
F5 BIG-IP Global Traffic Manager: version 11.5.0 only; version 11.5.1 only; version 11.5.2 only; version 11.6.0 only
F5 BIG-IP Link Controller: version 11.5.0 only; version 11.5.1 only; version 11.5.2 only; version 11.6.0 only
F5 BIG-IP Local Traffic Manager: version 11.5.0 only; version 11.5.1 only; version 11.5.2 only; version 11.6.0 only
F5 BIG-IP Policy Enforcement Manager: version 11.3.0 only; version 11.4.0 only; version 11.4.1 only; version 11.5.0 only; version 11.5.2 only; version 11.6.0 only
F5 BIG-IP Policy Enforcement MANAGER11.5.1: any version

Published 2015-05-12. Last modified 2026-06-17.