F5 BIG-IQ Centralized Management vulnerabilities

85 CVEs affecting F5 BIG-IQ Centralized Management, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-42406, published 2026-05-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-22986: F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability, published 2021-03-31. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.9% chance of exploitation in the next 30 days. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before…
CVE-2014-0196: Linux Kernel Race Condition Vulnerability, published 2014-05-07. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 22.5% chance of exploitation in the next 30 days. The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial…
CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability, published 2018-09-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-01-26. EPSS: 14.7% chance of exploitation in the next 30 days. An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate…
CVE-2022-41622, published 2022-12-07. High severity, CVSS 8.8. EPSS: 92.4% chance of exploitation in the next 30 days. In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS)…
CVE-2019-11479, published 2019-06-19. High severity, CVSS 7.5. EPSS: 91.7% chance of exploitation in the next 30 days. Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced.…
CVE-2002-20001, published 2021-11-11. High severity, CVSS 7.5. EPSS: 24.6% chance of exploitation in the next 30 days. The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE…
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2015-4047, published 2015-05-29. High severity, CVSS 7.8. EPSS: 9.7% chance of exploitation in the next 30 days. racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
CVE-2014-0101, published 2014-03-11. High severity, CVSS 7.8. EPSS: 7.2% chance of exploitation in the next 30 days. The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call,…
CVE-2018-5743, published 2019-10-09. High severity, CVSS 7.5. EPSS: 6.5% chance of exploitation in the next 30 days. By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a…

Latest

CVE-2026-42406, published 2026-05-13. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running…
CVE-2026-41959, published 2026-05-13. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated…
CVE-2026-41957, published 2026-05-13. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility. Note: Software versions which have reached End of Technical…
CVE-2026-41954, published 2026-05-13. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator…
CVE-2026-41219, published 2026-05-13. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file. Note: Software versions which…
CVE-2026-40698, published 2026-05-13. High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration objects through…
CVE-2026-32643, published 2026-05-13. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running…
CVE-2026-20916, published 2026-05-13. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system. Note: Software versions which have…
CVE-2024-47139, published 2024-10-16. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility that allows an attacker with the Administrator role to run JavaScript in the…
CVE-2024-24775, published 2024-02-14. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which…