Vulnerabilities in F5

421 results
Vexday analysis

Com 404 CVEs catalogadas e taxa de exploração ativa 2,2 vezes acima da média geral do catálogo CISA KEV, os produtos F5 exigem atenção redobrada na priorização de correções. O destaque mais crítico é CVE-2022-1388, com escore EPSS de 0,9996 — indicando probabilidade extremamente alta de exploração ativa —, o que a posiciona como prioridade imediata de remediação. A presença de 8 CVEs com PoC pública e 9 de severidade crítica amplia a superfície de risco explorável, especialmente considerando que 59 novas vulnerabilidades surgiram nos últimos 90 dias, sinalizando um ritmo relevante de descobertas recentes. O tipo de falha mais comum, CWE-476 (null pointer dereference), sugere oportunidades de melhoria estrutural no ciclo de desenvolvimento seguro, embora as explorações confirmadas tendam a concentrar-se nas falhas de controle de acesso e execução remota.

CVE-2024-23979HIGHBIG-IP SSL Client Certificate LDAP and CRLDP Authentication profiles vulnerabilityEPSS 0.3%CVE-2023-38423MEDIUMBIG-IP Configuration utility vulnerabilityEPSS 0.3%CVE-2025-59778HIGHVELOS partition container network vulnerabilityEPSS 0.3%CVE-2025-46405HIGHBIG-IP APM vulnerabilityEPSS 0.3%CVE-2025-52585HIGHBIG-IP Client SSL profile vulnerabilityEPSS 0.3%CVE-2022-27495MEDIUMOn all versions 1.3.x (fixed in 1.4.0) NGINX Service Mesh control plane endpoints are exposed to the cluster overlay network. Note: SoftwareEPSS 0.3%CVE-2020-5855—When the Windows Logon Integration feature is configured for all versions of BIG-IP Edge Client for Windows, unauthorized users who have phyEPSS 0.3%CVE-2026-40629HIGHBIG-IP SSL/TLS vulnerabilityEPSS 0.3%CVE-2026-40060HIGHBIG-IP Advanced WAF and ASM vulnerabilityEPSS 0.3%CVE-2026-40067HIGHBIG-IP APM VulnerabilityEPSS 0.3%CVE-2026-40618HIGHBIG-IP SSL/TLS vulnerabilityEPSS 0.3%CVE-2024-7347MEDIUMNGINX MP4 module vulnerabilityEPSS 0.3%CVE-2026-22549MEDIUMBIG-IP Container Ingress Services vulnerabilityEPSS 0.3%CVE-2024-33604MEDIUMBIG-IP Configuration utility XSS vulnerability EPSS 0.3%CVE-2019-6679—On BIG-IP versions 15.0.0-15.0.1, 14.1.0.2-14.1.2.2, 14.0.0.5-14.0.1, 13.1.1.5-13.1.3.1, 12.1.4.1-12.1.5, 11.6.4-11.6.5, and 11.5.9-11.5.10,EPSS 0.3%CVE-2026-77180HIGHNGINX Ingress Controller vulnerabilityEPSS 0.3%CVE-2025-54805MEDIUMTMM VulnerabilityEPSS 0.3%CVE-2025-55670HIGHBIG-IP Next (CNF, SPK, and Kubernetes) vulnerabilityEPSS 0.3%CVE-2024-23603LOWBIG-IP Advanced WAF and ASM Configuration utility vulnerability EPSS 0.3%CVE-2024-41723MEDIUMBIG-IP iControl REST vulnerabilityEPSS 0.3%