CVE-2021-23046: F5 BIG-IP Access Policy Manager

Medium severity, CVSS 4.9. EPSS: 0.8% chance of exploitation in the next 30 days.

On all versions of Guided Configuration before 8.0.0, when a configuration that contains secure properties is created and deployed from Access Guided Configuration (AGC), secure properties are logged in restnoded logs. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

• F5 BIG-IP Access Policy Manager: from 13.1.0, up to and including 13.1.4; from 14.1.0, up to and including 14.1.4; from 15.1.0, up to and including 15.1.3; from 16.0.0, before 16.1.0 (fixed in 16.1.0)
• F5 BIG-IP Guided Configuration: before 8.0.0 (fixed in 8.0.0)

Published 2021-09-14. Last modified 2026-06-17.