CVE-2022-27189: F5 BIG-IP Access Policy Manager

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when an Internet Content Adaptation Protocol (ICAP) profile is configured on a virtual server, undisclosed traffic can cause an increase in Traffic Management Microkernel (TMM) memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected products

F5 BIG-IP Access Policy Manager: version 11.6.1 only; version 11.6.2 only; version 11.6.3 only; version 11.6.4 only; version 11.6.5 only; version 12.1.0 only; …
F5 BIG-IP Advanced Firewall Manager: version 11.6.1 only; version 11.6.2 only; version 11.6.3 only; version 11.6.4 only; version 11.6.5 only; version 12.1.0 only; …
F5 BIG-IP Analytics: version 11.6.1 only; version 11.6.2 only; version 11.6.3 only; version 11.6.4 only; version 11.6.5 only; version 12.1.0 only; …
F5 BIG-IP Application Acceleration Manager: version 11.6.1 only; version 11.6.2 only; version 11.6.3 only; version 11.6.4 only; version 11.6.5 only; version 12.1.0 only; …
F5 BIG-IP Application Security Manager: version 11.6.1 only; version 11.6.2 only; version 11.6.3 only; version 11.6.4 only; version 11.6.5 only; version 12.1.0 only; …
F5 BIG-IP Domain Name System: version 11.6.1 only; version 11.6.2 only; version 11.6.3 only; version 11.6.4 only; version 11.6.5 only; version 12.1.0 only; …
F5 BIG-IP Fraud Protection Service: version 11.6.1 only; version 11.6.2 only; version 11.6.3 only; version 11.6.4 only; version 11.6.5 only; version 12.1.0 only; …
F5 BIG-IP Global Traffic Manager: version 11.6.1 only; version 11.6.2 only; version 11.6.3 only; version 11.6.4 only; version 11.6.5 only; version 12.1.0 only; …
F5 BIG-IP Link Controller: version 11.6.1 only; version 11.6.2 only; version 11.6.3 only; version 11.6.4 only; version 11.6.5 only; version 12.1.0 only; …
F5 BIG-IP Local Traffic Manager: version 11.6.1 only; version 11.6.2 only; version 11.6.3 only; version 11.6.4 only; version 11.6.5 only; version 12.1.0 only; …
F5 BIG-IP Policy Enforcement Manager: version 11.6.1 only; version 11.6.2 only; version 11.6.3 only; version 11.6.4 only; version 11.6.5 only; version 12.1.0 only; …

Published 2022-05-05. Last modified 2026-06-17.