F5 BIG-IP SSL Orchestrator vulnerabilities

147 CVEs affecting F5 BIG-IP SSL Orchestrator, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-63020, published 2026-09-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2023-46747: F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability, published 2023-10-26. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-10-31. EPSS: 96.5% chance of exploitation in the next 30 days. Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute…
CVE-2023-46748: F5 BIG-IP Configuration Utility SQL Injection Vulnerability, published 2023-10-26. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-10-31. EPSS: 4.5% chance of exploitation in the next 30 days. An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP…
CVE-2023-22374, published 2023-02-01. High severity, CVSS 8.5. EPSS: 72.6% chance of exploitation in the next 30 days. A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a…
CVE-2002-20001, published 2021-11-11. High severity, CVSS 7.5. EPSS: 24.6% chance of exploitation in the next 30 days. The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE…
CVE-2025-31644, published 2025-05-07. High severity, CVSS 8.7. EPSS: 24.3% chance of exploitation in the next 30 days. When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with…
CVE-2024-45844, published 2024-10-16. High severity, CVSS 7.2. EPSS: 10.6% chance of exploitation in the next 30 days. BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical…
CVE-2025-20029, published 2025-02-05. High severity, CVSS 8.8. EPSS: 7.2% chance of exploitation in the next 30 days. Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software…
CVE-2023-41373, published 2023-10-10. Critical severity, CVSS 9.9. EPSS: 2.3% chance of exploitation in the next 30 days. A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in…
CVE-2021-23025, published 2021-09-14. High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days. On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated remote command execution vulnerability exists in the BIG-IP…

Latest

CVE-2026-63020, published 2026-09-02. Low severity, CVSS 3.1. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into…
CVE-2026-42937, published 2026-05-13. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated…
CVE-2026-42930, published 2026-05-13. High severity, CVSS 8.7. EPSS: 0.6% chance of exploitation in the next 30 days. When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system. Note: Software versions which have…
CVE-2026-42924, published 2026-05-13. High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days. An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions…
CVE-2026-42920, published 2026-05-13. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software…
CVE-2026-42919, published 2026-05-13. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a…
CVE-2026-42781, published 2026-05-13. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource…
CVE-2026-42780, published 2026-05-13. Medium severity, CVSS 4.9. EPSS: 1.2% chance of exploitation in the next 30 days. A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwrite, delete or corrupt arbitrary local files. Note: Software…
CVE-2026-42409, published 2026-05-13. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM)…
CVE-2026-42408, published 2026-05-13. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information. Note:…