CVE-2022-28705: F5 BIG-IP Access Policy Manager

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, on platforms with an ePVA and the pva.fwdaccel BigDB variable enabled, undisclosed requests to a virtual server with a FastL4 profile that has ePVA acceleration enabled can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected products

  • F5 BIG-IP Access Policy Manager: version 13.1.0 only; version 13.1.1 only; version 13.1.3 only; version 13.1.4 only; version 13.1.5 only; version 14.1.0 only; …
  • F5 BIG-IP Advanced Firewall Manager: version 13.1.0 only; version 13.1.1 only; version 13.1.3 only; version 13.1.4 only; version 13.1.5 only; version 14.1.0 only; …
  • F5 BIG-IP Analytics: version 13.1.0 only; version 13.1.1 only; version 13.1.3 only; version 13.1.4 only; version 13.1.5 only; version 14.1.0 only; …
  • F5 BIG-IP Application Acceleration Manager: version 13.1.0 only; version 13.1.1 only; version 13.1.3 only; version 13.1.4 only; version 13.1.5 only; version 14.1.0 only; …
  • F5 BIG-IP Application Security Manager: version 13.1.0 only; version 13.1.1 only; version 13.1.3 only; version 13.1.4 only; version 13.1.5 only; version 14.1.0 only; …
  • F5 BIG-IP Domain Name System: version 13.1.0 only; version 13.1.1 only; version 13.1.3 only; version 13.1.4 only; version 13.1.5 only; version 14.1.0 only; …
  • F5 BIG-IP Fraud Protection Service: version 13.1.0 only; version 13.1.1 only; version 13.1.3 only; version 13.1.4 only; version 13.1.5 only; version 14.1.0 only; …
  • F5 BIG-IP Global Traffic Manager: version 13.1.0 only; version 13.1.1 only; version 13.1.3 only; version 13.1.4 only; version 13.1.5 only; version 14.1.0 only; …
  • F5 BIG-IP Link Controller: version 13.1.0 only; version 13.1.1 only; version 13.1.3 only; version 13.1.4 only; version 13.1.5 only; version 14.1.0 only; …
  • F5 BIG-IP Local Traffic Manager: version 13.1.0 only; version 13.1.1 only; version 13.1.3 only; version 13.1.4 only; version 13.1.5 only; version 14.1.0 only; …
  • F5 BIG-IP Policy Enforcement Manager: version 13.1.0 only; version 13.1.1 only; version 13.1.3 only; version 13.1.4 only; version 13.1.5 only; version 14.1.0 only; …

Published 2022-05-05. Last modified 2026-06-17.