CVE-2015-8611: F5 BIG-IP Access Policy Manager

Critical severity, CVSS 9.8. EPSS: 3.2% chance of exploitation in the next 30 days.

BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly sync passwords with the Always-On Management (AOM) subsystem, which might allow remote attackers to obtain login access to AOM via an (1) expired or (2) default password.

Affected products

• F5 BIG-IP Access Policy Manager: version 12.0.0 only
• F5 BIG-IP Advanced Firewall Manager: version 12.0.0 only
• F5 BIG-IP Analytics: version 12.0.0 only
• F5 BIG-IP Application Acceleration Manager: version 12.0.0 only
• F5 BIG-IP Application Security Manager: version 12.0.0 only
• F5 BIG-IP Domain Name System: version 12.0.0 only
• F5 BIG-IP Link Controller: version 12.0.0 only
• F5 BIG-IP Local Traffic Manager: version 12.0.0 only
• F5 BIG-IP Policy Enforcement Manager: version 12.0.0 only

Published 2016-01-12. Last modified 2026-06-17.