CVE-2021-22980: F5 Access Policy Manager Clients

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Affected products

• F5 Access Policy Manager Clients: from 7.1.5, before 7.1.8.5 (fixed in 7.1.8.5); from 7.1.9, before 7.1.9.8 (fixed in 7.1.9.8); from 7.2.1, before 7.2.1.1 (fixed in 7.2.1.1)
• F5 BIG-IP Access Policy Manager: from 11.6.1, up to and including 11.6.5; from 12.1.0, up to and including 12.1.5; from 13.1.0, before 13.1.3.6 (fixed in 13.1.3.6); from 14.1.0, up to and including 14.1.3; from 15.1.0, up to and including 15.1.2; from 16.0.0, before 16.0.1.1 (fixed in 16.0.1.1)

Published 2021-02-12. Last modified 2026-06-17.