F5 BIG-IP Access Policy Manager Client vulnerabilities

20 CVEs affecting F5 BIG-IP Access Policy Manager Client, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-20730, published 2026-02-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-6656, published 2019-09-25. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. BIG-IP APM Edge Client before version 7.1.8 (7180.2019.508.705) logs the full apm session ID in the log files. Vulnerable versions of the client are bundled with BIG-IP APM versions 15.0.0-15.0.1,…
CVE-2020-5897, published 2020-05-12. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. In versions 7.1.5-7.1.9, there is use-after-free memory vulnerability in the BIG-IP Edge Client Windows ActiveX component.
CVE-2018-15316, published 2018-10-19. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. In F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, and/or Edge Client 7101-7160, the BIG-IP APM Edge Client component loads the policy library with user permission and bypassing the endpoint…
CVE-2020-5893, published 2020-04-30. Low severity, CVSS 3.7. EPSS: 0.6% chance of exploitation in the next 30 days. In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for…
CVE-2018-5546, published 2018-08-17. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files…
CVE-2022-23032, published 2022-01-25. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP Edge Client on Mac and Windows is vulnerable to a DNS…
CVE-2020-5855, published 2020-02-06. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. When the Windows Logon Integration feature is configured for all versions of BIG-IP Edge Client for Windows, unauthorized users who have physical access to an authorized user's machine can get shell…
CVE-2018-15332, published 2018-12-06. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. The svpn component of the F5 BIG-IP APM client prior to version 7.1.7.2 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on…
CVE-2020-5892, published 2020-04-30. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory.
CVE-2022-28714, published 2022-05-05. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as…

Latest

CVE-2026-20730, published 2026-02-04. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information. Note: Software versions which have reached End of…
CVE-2025-48500, published 2025-08-13. High severity, CVSS 7.3. EPSS: 0.1% chance of exploitation in the next 30 days. A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a…
CVE-2024-28883, published 2024-05-08. High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days. An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to bypass F5 endpoint inspection. Note:…
CVE-2023-43125, published 2023-09-27. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2023-43124, published 2023-09-27. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2022-27636, published 2022-05-05. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as…
CVE-2021-23022, published 2021-06-10. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client Windows Installer Service's temporary folder has weak file and folder permissions. Note: Software versions…
CVE-2020-5898, published 2020-05-12. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. In versions 7.1.5-7.1.9, BIG-IP Edge Client Windows Stonewall driver does not sanitize the pointer received from the userland. A local user on the Windows client system can send crafted…