CVE-2023-22302: F5 BIG-IP Access Policy Manager

Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days.

In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker’s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

  • F5 BIG-IP Access Policy Manager: from 16.1.2.2, before 16.1.3.3 (fixed in 16.1.3.3); from 17.0.0, before 17.0.0.2 (fixed in 17.0.0.2)
  • F5 BIG-IP Advanced Firewall Manager: from 16.1.2.2, before 16.1.3.3 (fixed in 16.1.3.3); from 17.0.0, before 17.0.0.2 (fixed in 17.0.0.2)
  • F5 BIG-IP Analytics: from 16.1.2.2, before 16.1.3.3 (fixed in 16.1.3.3); from 17.0.0, before 17.0.0.2 (fixed in 17.0.0.2)
  • F5 BIG-IP Application Acceleration Manager: from 16.1.2.2, before 16.1.3.3 (fixed in 16.1.3.3); from 17.0.0, before 17.0.0.2 (fixed in 17.0.0.2)
  • F5 BIG-IP Application Security Manager: from 16.1.2.2, before 16.1.3.3 (fixed in 16.1.3.3); from 17.0.0, before 17.0.0.2 (fixed in 17.0.0.2)
  • F5 BIG-IP Ddos Hybrid Defender: from 16.1.2.2, before 16.1.3.3 (fixed in 16.1.3.3); from 17.0.0, before 17.0.0.2 (fixed in 17.0.0.2)
  • F5 BIG-IP Domain Name System: from 16.1.2.2, before 16.1.3.3 (fixed in 16.1.3.3); from 17.0.0, before 17.0.0.2 (fixed in 17.0.0.2)
  • F5 BIG-IP Fraud Protection Service: from 16.1.2.2, before 16.1.3.3 (fixed in 16.1.3.3); from 17.0.0, before 17.0.0.2 (fixed in 17.0.0.2)
  • F5 BIG-IP Link Controller: from 16.1.2.2, before 16.1.3.3 (fixed in 16.1.3.3); from 17.0.0, before 17.0.0.2 (fixed in 17.0.0.2)
  • F5 BIG-IP Local Traffic Manager: from 16.1.2.2, before 16.1.3.3 (fixed in 16.1.3.3); from 17.0.0, before 17.0.0.2 (fixed in 17.0.0.2)
  • F5 BIG-IP Policy Enforcement Manager: from 16.1.2.2, before 16.1.3.3 (fixed in 16.1.3.3); from 17.0.0, before 17.0.0.2 (fixed in 17.0.0.2)
  • F5 BIG-IP SSL Orchestrator: from 16.1.2.2, before 16.1.3.3 (fixed in 16.1.3.3); from 17.0.0, before 17.0.0.2 (fixed in 17.0.0.2)

Published 2023-02-01. Last modified 2026-06-17.