F5 BIG-IP Container Ingress Services vulnerabilities

86 CVEs affecting F5 BIG-IP Container Ingress Services, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-63020, published 2026-09-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-46747: F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability, published 2023-10-26. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-10-31. EPSS: 96.5% chance of exploitation in the next 30 days. Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute…
CVE-2023-46748: F5 BIG-IP Configuration Utility SQL Injection Vulnerability, published 2023-10-26. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-10-31. EPSS: 4.5% chance of exploitation in the next 30 days. An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP…
CVE-2025-31644, published 2025-05-07. High severity, CVSS 8.7. EPSS: 24.3% chance of exploitation in the next 30 days. When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with…
CVE-2024-45844, published 2024-10-16. High severity, CVSS 7.2. EPSS: 10.6% chance of exploitation in the next 30 days. BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical…
CVE-2025-20029, published 2025-02-05. High severity, CVSS 8.8. EPSS: 7.2% chance of exploitation in the next 30 days. Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software…
CVE-2025-54755, published 2025-10-15. Medium severity, CVSS 4.9. EPSS: 1.2% chance of exploitation in the next 30 days. A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files which are not limited to the intended files. Note: Software versions which…
CVE-2026-34176, published 2026-05-13. High severity, CVSS 8.7. EPSS: 0.9% chance of exploitation in the next 30 days. When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a…
CVE-2026-24464, published 2026-05-13. Medium severity, CVSS 6.8. EPSS: 0.9% chance of exploitation in the next 30 days. When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to…
CVE-2026-41957, published 2026-05-13. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility. Note: Software versions which have reached End of Technical…
CVE-2024-33608, published 2024-05-08. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical…

Latest

CVE-2026-63020, published 2026-09-02. Low severity, CVSS 3.1. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into…
CVE-2026-42937, published 2026-05-13. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated…
CVE-2026-42930, published 2026-05-13. High severity, CVSS 8.7. EPSS: 0.6% chance of exploitation in the next 30 days. When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system. Note: Software versions which have…
CVE-2026-42924, published 2026-05-13. High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days. An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions…
CVE-2026-42920, published 2026-05-13. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software…
CVE-2026-42919, published 2026-05-13. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a…
CVE-2026-42781, published 2026-05-13. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource…
CVE-2026-42409, published 2026-05-13. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM)…
CVE-2026-42408, published 2026-05-13. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information. Note:…
CVE-2026-42406, published 2026-05-13. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running…