These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-41954 is a sensitive information disclosure vulnerability in undisclosed iControl REST endpoint and TMOS Shell (tmsh) command of F5 products. An authenticated attacker with resource administrator role privileges may be able to view sensitive information. The vulnerability has a CVSS score of 6.9 and a severity of MEDIUM. F5 has provided mitigation guidance in article K32950402.
CVE-2026-41953 is a high-severity vulnerability in BIG-IP systems that allows a highly privileged, authenticated attacker to modify configuration objects, resulting in privilege escalation. The vulnerability has a CVSS score of 8.5 and is considered HIGH. F5 has provided mitigation guidance for this issue. Software versions that have reached End of Technical Support (EoTS) are not evaluated. The CVE was p [truncated]
CVE-2026-41227 is a vulnerability in F5 BIG-IP Advanced Web Application Firewall that can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate. This issue affects multiple F5 products, including BIG-IP Advanced Web Application Firewall, BIG-IP Application Security Manager, and BIG-IP DDoS Hybrid Defender. The vulnerability has a CVSS score of 8. [truncated]
CVE-2026-41225 is a vulnerability in F5 iControl REST that allows a highly privileged, authenticated attacker with at least the Manager role to create configuration objects that enable running arbitrary commands. This issue affects multiple F5 products across various versions. The vulnerability has a CVSS score of 8.6 and is classified as HIGH severity. F5 has provided mitigation guidance for this issue.
A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. This vulnerability, tracked as CVE-2026-40703, has a CVSS score of 5.3 and is considered medium severity. The vulnerability affects various versions of BIG-IP products, including BIG-IP Access Policy Manager, BIG-IP Advanced Firewall Manager, and others. Software versions that have reached End of [truncated]
CVE-2026-40699 is a high-severity vulnerability in F5 BIG-IP Access Policy Manager. A low-privileged authenticated attacker may access undisclosed sensitive information. The vulnerability has a CVSS score of 7.1 and is considered HIGH. F5 has provided mitigation guidance. Software versions that have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-40698 is a high-severity vulnerability in BIG-IP and BIG-IQ systems that allows a highly privileged, authenticated attacker with at least the Resource Administrator role to create SNMP configuration objects through iControl REST or the TMOS shell (tmsh), resulting in privilege escalation. This vulnerability has a CVSS score of 8.5 and is considered HIGH. The vulnerability affects multiple version [truncated]
CVE-2026-40631 is a HIGH severity vulnerability in F5 BIG-IP products. An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP, resulting in privilege escalation. This issue affects multiple F5 BIG-IP products across various versions. Software versions that have reached End of Technical Support (EoTS) are not evaluated. F5 has [truncated]
CVE-2026-40629 is a HIGH severity vulnerability in F5 BIG-IP products. When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. This issue affects multiple F5 BIG-IP products across various versions. The vulnerability has a CVSS score of 8.7. F5 has provided mitigation guidance.
A high-severity vulnerability was discovered in BIG-IP, a product by F5 Networks. The vulnerability, tracked as CVE-2026-40618, can cause the Traffic Management Microkernel (TMM) to terminate when an SSL profile is configured on a virtual server without Intel QuickAssist Technology (QAT) or when the database variable crypto.hwacceleration is set to disabled. This can lead to a denial of service, making th [truncated]
CVE-2026-40462 is a high-severity vulnerability in F5 products, allowing authenticated attackers to view sensitive information. The vulnerability exists in iControl REST and TMOS shell (tmsh) undisclosed command. Software versions that have reached End of Technical Support (EoTS) are not evaluated. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 7.1, indicating a high severi [truncated]
CVE-2026-40460 is a medium-severity vulnerability affecting NGINX Plus and NGINX Open Source when configured to use the HTTP/3 QUIC module. An attacker may exploit this vulnerability to spoof their source IP address, potentially bypassing authorization or rate limiting. The vulnerability has a CVSS score of 6.9 and is considered medium severity. Software versions that have reached End of Technical Support [truncated]
CVE-2026-40435 is a vulnerability in F5 BIG-IP products where IP-based access restrictions for httpd do not cover all endpoints. This may allow connections from blocked addresses. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Software versions that have reached End of Technical Support (EoTS) are not evaluated. The CVE was published on May 13, 2026, and modified on June 29, 2026.
A vulnerability in BIG-IP APM access policy can cause the apmd process to terminate when undisclosed traffic is received. This HIGH-severity vulnerability has a CVSS score of 8.7. The affected products are BIG-IP Access Policy Manager versions 16.1.0 to 16.1.6, 17.1.0 to 17.1.3, and 17.5.0 to 17.5.1. Software versions that have reached End of Technical Support (EoTS) are not evaluated.
A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command in BIG-IP DNS, which allows an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. This vulnerability has a CVSS score of 8.5 [truncated]
CVE-2026-40060 is a HIGH-severity vulnerability (CVSS Score: 8.7) affecting BIG-IP Advanced WAF or ASM security policy. When a security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. The vulnerability was published on May 13, 2026, and modified on June 29, 2026. F5 is the affected vendor. Software versions that have reached End of Technical Support (E [truncated]
CVE-2026-39459 is a highly severe vulnerability with a CVSS score of 8.6. A highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands via iControl REST and TMOS Shell (tmsh). This vulnerability affects multiple F5 BIG-IP products across various versions. Software versions that have reached End of Technical Support (EoTS) [truncated]
CVE-2026-34019 is a medium-severity vulnerability affecting F5 BIG-IP products. When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to stop processing BFD packets. This can lead to the configured routing protocol failing over. The vulnerability has a CVSS score of 6.3 and is considered m [truncated]
A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands. This issue affects multiple versions of BIG-IP and BIG-IQ systems. Software versions which have reached End of Technical Support (EoTS) are not evaluated.
A vulnerability exists in the gtm_add and bigip_add iControl REST commands of BIG-IP DNS. When BIG-IP DNS is provisioned, these commands return the ssh-password parameter in cleartext in the iControl REST response. The cleartext password is also logged in the audit log. A highly privileged, authenticated attacker with access to the audit log could view sensitive information. This issue affects multiple ve [truncated]
CVE-2026-20916 is a highly severe vulnerability affecting F5's BIG-IQ Centralized Management. An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint. The vulnerability has a CVSS score of 7.2 and is classified as HIGH. F5 has provided mitigation guidance for this issue. Users should review and apply the necessary patches o [truncated]
CVE-2025-53521 is a known-exploited F5 BIG-IP stack-based buffer overflow vulnerability listed by CISA in the Known Exploited Vulnerabilities catalog on 2026-03-27, with a remediation due date of 2026-03-30. Based on the supplied official sources, the safest assumption is that affected BIG-IP deployments should be treated as urgent priority, especially if internet-facing. Follow F5’s mitigation guidance, [truncated]
CVE-2026-32647 is a high-severity vulnerability affecting NGINX Open Source and NGINX Plus. The vulnerability is located in the ngx_http_mp4_module module and can be exploited using a specially crafted MP4 file, potentially leading to buffer over-read or over-write, causing NGINX worker memory termination or code execution. The vulnerability has a CVSS score of 8.5 and is considered HIGH. This issue affec [truncated]
CVE-2026-27784 is a vulnerability in the 32-bit implementation of NGINX Open Source's ngx_http_mp4_module module. This issue may allow an attacker to over-read or over-write NGINX worker memory, resulting in its termination, using a specially crafted MP4 file. The vulnerability only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the con [truncated]
CVE-2026-27654 is a high-severity vulnerability in NGINX Open Source and NGINX Plus that could allow an attacker to trigger a buffer overflow, potentially disrupting the NGINX worker process or modifying file names outside the document root. The vulnerability affects configurations using the DAV module's MOVE or COPY methods, prefix locations, and alias directives. The impact is somewhat constrained due t [truncated]
CVE-2023-46748 is a SQL injection vulnerability in the F5 BIG-IP Configuration Utility that CISA added to its Known Exploited Vulnerabilities catalog on 2023-10-31. Because CISA lists it as actively exploited, affected environments should be treated as urgent remediation items. The supplied official sources confirm the KEV status and the vendor product name, but do not provide affected versions or CVSS da [truncated]
CVE-2023-46747 affects the F5 BIG-IP Configuration Utility and is described as an authentication bypass vulnerability. CISA added it to the Known Exploited Vulnerabilities catalog on 2023-10-31, and the KEV record notes known ransomware campaign use. Because the source corpus identifies this as a known exploited issue, defenders should treat it as urgent and follow vendor guidance immediately; if mitigati [truncated]
CVE-2022-1388 affects F5 BIG-IP and is described as a missing authentication vulnerability. CISA lists it in the Known Exploited Vulnerabilities catalog, which indicates confirmed exploitation and makes it a high-priority remediation item. CISA also records known ransomware campaign use. The defensive takeaway is straightforward: treat this as urgent, apply vendor updates per F5 guidance, and prioritize a [truncated]
CVE-2021-22991 is a buffer overflow affecting F5 BIG-IP Traffic Management Microkernel. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-01-18, which means it should be treated as a high-priority remediation item. The corpus provided here does not include affected versions, exploit mechanics, or vendor advisory details, so the safest defensive response is to follow F5 remediation guida [truncated]
CVE-2021-22986 is a high-priority F5 vulnerability affecting BIG-IP and BIG-IQ Centralized Management. The issue is described as an iControl REST remote code execution vulnerability and was added to CISA’s Known Exploited Vulnerabilities catalog on 2021-11-03. CISA also marks it as associated with known ransomware campaign use, which raises the urgency for remediation. For defenders, this is a “patch now” [truncated]