CVE-2018-15326: F5 BIG-IP Access Policy Manager

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent may treat revoked certificates as valid when the BIG-IP APM system fails to download a new Certificate Revocation List.

Affected products

• F5 BIG-IP Access Policy Manager: from 11.6.0, up to and including 11.6.3.2; from 12.1.0, up to and including 12.1.3.5; from 13.0.0, up to and including 13.1.0.7; from 14.0.0, up to and including 14.0.0.2

Published 2018-10-31. Last modified 2026-06-17.