CVE-2019-6634: F5 BIG-IP Access Policy Manager

Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days.

On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, a high volume of malformed analytics report requests leads to instability in restjavad process. This causes issues with both iControl REST and some portions of TMUI. The attack requires an authenticated user with any role.

Affected products

F5 BIG-IP Access Policy Manager: from 12.1.0, before 12.1.4.1 (fixed in 12.1.4.1); from 13.0.0, before 13.1.1.5 (fixed in 13.1.1.5); from 14.0.0, before 14.0.0.5 (fixed in 14.0.0.5); from 14.1.0, before 14.1.0.6 (fixed in 14.1.0.6)
F5 BIG-IP Advanced Firewall Manager: from 12.1.0, before 12.1.4.1 (fixed in 12.1.4.1); from 13.0.0, before 13.1.1.5 (fixed in 13.1.1.5); from 14.0.0, before 14.0.0.5 (fixed in 14.0.0.5); from 14.1.0, before 14.1.0.6 (fixed in 14.1.0.6)
F5 BIG-IP Analytics: from 12.1.0, before 12.1.4.1 (fixed in 12.1.4.1); from 13.0.0, before 13.1.1.5 (fixed in 13.1.1.5); from 14.0.0, before 14.0.0.5 (fixed in 14.0.0.5); from 14.1.0, before 14.1.0.6 (fixed in 14.1.0.6)
F5 BIG-IP Application Acceleration Manager: from 12.1.0, before 12.1.4.1 (fixed in 12.1.4.1); from 13.0.0, before 13.1.1.5 (fixed in 13.1.1.5); from 14.0.0, before 14.0.0.5 (fixed in 14.0.0.5); from 14.1.0, before 14.1.0.6 (fixed in 14.1.0.6)
F5 BIG-IP Application Security Manager: from 12.1.0, before 12.1.4.1 (fixed in 12.1.4.1); from 13.0.0, before 13.1.1.5 (fixed in 13.1.1.5); from 14.0.0, before 14.0.0.5 (fixed in 14.0.0.5); from 14.1.0, before 14.1.0.6 (fixed in 14.1.0.6)
F5 BIG-IP Domain Name System: from 12.1.0, before 12.1.4.1 (fixed in 12.1.4.1); from 13.0.0, before 13.1.1.5 (fixed in 13.1.1.5); from 14.0.0, before 14.0.0.5 (fixed in 14.0.0.5); from 14.1.0, before 14.1.0.6 (fixed in 14.1.0.6)
F5 BIG-IP Edge Gateway: from 12.1.0, before 12.1.4.1 (fixed in 12.1.4.1); from 13.0.0, before 13.1.1.5 (fixed in 13.1.1.5); from 14.0.0, before 14.0.0.5 (fixed in 14.0.0.5); from 14.1.0, before 14.1.0.6 (fixed in 14.1.0.6)
F5 BIG-IP Fraud Protection Service: from 12.1.0, before 12.1.4.1 (fixed in 12.1.4.1); from 13.0.0, before 13.1.1.5 (fixed in 13.1.1.5); from 14.0.0, before 14.0.0.5 (fixed in 14.0.0.5); from 14.1.0, before 14.1.0.6 (fixed in 14.1.0.6)
F5 BIG-IP Global Traffic Manager: from 12.1.0, before 12.1.4.1 (fixed in 12.1.4.1); from 13.0.0, before 13.1.1.5 (fixed in 13.1.1.5); from 14.0.0, before 14.0.0.5 (fixed in 14.0.0.5); from 14.1.0, before 14.1.0.6 (fixed in 14.1.0.6)
F5 BIG-IP Link Controller: from 12.1.0, before 12.1.4.1 (fixed in 12.1.4.1); from 13.0.0, before 13.1.1.5 (fixed in 13.1.1.5); from 14.0.0, before 14.0.0.5 (fixed in 14.0.0.5); from 14.1.0, before 14.1.0.6 (fixed in 14.1.0.6)
F5 BIG-IP Local Traffic Manager: from 12.1.0, before 12.1.4.1 (fixed in 12.1.4.1); from 13.0.0, before 13.1.1.5 (fixed in 13.1.1.5); from 14.0.0, before 14.0.0.5 (fixed in 14.0.0.5); from 14.1.0, before 14.1.0.6 (fixed in 14.1.0.6)
F5 BIG-IP Policy Enforcement Manager: from 12.1.0, before 12.1.4.1 (fixed in 12.1.4.1); from 13.0.0, before 13.1.1.5 (fixed in 13.1.1.5); from 14.0.0, before 14.0.0.5 (fixed in 14.0.0.5); from 14.1.0, before 14.1.0.6 (fixed in 14.1.0.6)
F5 BIG-IP Webaccelerator: from 12.1.0, before 12.1.4.1 (fixed in 12.1.4.1); from 13.0.0, before 13.1.1.5 (fixed in 13.1.1.5); from 14.0.0, before 14.0.0.5 (fixed in 14.0.0.5); from 14.1.0, before 14.1.0.6 (fixed in 14.1.0.6)

Published 2019-07-03. Last modified 2026-06-17.