← Search results
CVE-LINKED INVENTORY13 SECURITY RECORDS
F5
BIG-IP APM
Affected and fixed version statements observed in the public BlackTree CVE catalogue. These statements describe vulnerability scope, not publisher support entitlement.
This identity is present in BlackTree CVE records, but no product-specific publisher support or retirement history is currently registered in Lifecycle.
A missing support date does not mean the product is supported. CVE publication dates and affected-version ranges must not be interpreted as EOL dates.
CVE-observed version history
| CVE | Published | Affected versions | Fixed version information | Publisher evidence |
|---|---|---|---|---|
| CVE-2026-94127 | 22 Sep 2026 | BIG-IP: 21.1.0 < Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, 17.5.0 < Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, 17.1.0 < Hotfix-BIGIP-17.1.3.5.0.41.14-ENG | The Cyber Centre strongly recommends that organizations running affected F5 BIG‑IP APM deployments upgrade to the following vendor-supported fixed hotfix releases: Affected product Affected versions Fixed Versions BIG IP APM Versions 17.1.0 prior to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG Version 17.1.0 Hotfix-BIGIP-17.1.3.5.0.41.14-ENG BIG IP APM Versions 17.5.0 prior to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG Version 17.5.0 Hotfix-BIGIP-17.5.1.9.0.160.12-ENG BIG IP APM Versions 21.1.0 prior to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG Version 21.1.0 Hotfix-BIGIP-21.1.0.2.0.30.22-ENG The Cyber Centre also recommends organizations to: Identify vulnerable BIG IP systems that have both an APM access policy and an OAuth profile configured on a virtual server. Apply the vendor-provided iRule (contact F5 Support to obtain the iRule) Footnote 1 . Review access logs for indicators of compromise (IoC), particularly OAuth authentication failures especially in rapid succession or large volume Footnote 1 . Also review administrative accounts, access policies for any signs of suspicious activity. Upgrade to a vendor-supported fixed software version as soon as possible. Ensure management interfaces are restricted to trusted administrative networks. Follow F5 guidance for vulnerability remediation and validation following patch deployment. Note: Organizations operating Common Criteria Footnote 5 evaluated configurations should review F5's advisory Footnote 1 and apply the recommended updates in accordance with their change management and certification requirements. In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions Footnote 6 with an emphasis on the following topics: Consolidating, monitoring, and defending Internet gateways Patch operating systems and applications Harden operating systems and applications Isolate web-facing applications Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal , or email contact@cyber.gc.ca . | Update reference ↗ |
| CVE-2022-35245 | 4 Aug 2022 | 14.1.x < 14.1.5.1; 15.1.x < 15.1.6.1; 16.1.x < 16.1.3.1 | 13.1.0 < 13.1.x*; 17.0.0 < 17.0.x* | Update reference ↗ |
| CVE-2022-33203 | 4 Aug 2022 | 14.1.x < 14.1.5; 15.1.x < 15.1.6.1; 16.1.x < 16.1.3 | 13.1.0 < 13.1.x*; 17.0.0 < 17.0.x* | Update reference ↗ |
| CVE-2022-31473 | 4 Aug 2022 | 15.1.x < 15.1.4; 16.1.x < 16.1.1 | 13.1.0 < 13.1.x*; 14.1.0 < 14.1.x*; 17.0.0 < 17.0.x* | Update reference ↗ |
| CVE-2022-29263 | 5 May 2022 | BIG-IP APM: 12.1.x, 11.6.x, 16.1.x < 16.1.2.2, 15.1.x < 15.1.5.1, 14.1.x < 14.1.4.6, 13.1.x < 13.1.5; BIG-IP APM Clients: 7.x < 7.2.1.5 | BIG-IP APM: 17.0.0 < 17.0.x* | Update reference ↗ |
| CVE-2022-28714 | 5 May 2022 | 12.1.x; 11.6.x; 16.1.x < 16.1.2.2; 15.1.x < 15.1.5.1; 14.1.x < 14.1.4.6; 13.1.x < 13.1.5; 7.x < 7.2.1.5 | 17.0.0 < 17.0.x* | Update reference ↗ |
| CVE-2022-27636 | 5 May 2022 | 12.1.x; 11.6.x; 16.1.x < 16.1.2.2; 15.1.x < 15.1.5.1; 14.1.x < 14.1.4.6; 13.1.x < 13.1.5; 7.x < 7.2.1.5 | 17.0.0 < 17.0.x* | Update reference ↗ |
| CVE-2022-27634 | 5 May 2022 | 16.1.x < 16.1.2.2; 15.1.x < 15.1.5.1 | 14.1.x; 13.1.x; 12.1.x; 11.6.x; 17.0.0 < 17.0.x* | Update reference ↗ |
| CVE-2022-27230 | 5 May 2022 | 16.1.x; 15.1.x; 14.1.x; 13.1.x; 12.1.x; 11.6.x; All < 9.0 | 17.0.0 < 17.0.x* | Update reference ↗ |
| CVE-2022-27181 | 5 May 2022 | 12.1.x; 11.6.x; 16.1.x < 16.1.2.2; 15.1.x < 15.1.5.1; 14.1.x < 14.1.4.6; 13.1.x < 13.1.5 | 17.0.0 < 17.0.x* | Update reference ↗ |
| CVE-2020-5853 | 14 Jan 2020 | 15.0.0-15.1.0; 14.0.0-14.1.2.3; 13.1.0-13.1.3.2; 12.1.0-12.1.5; 11.5.2-11.6.5.1 | No fixed version is explicitly recorded in the structured CVE data. | Use CVE record |
| CVE-2019-19150 | 23 Dec 2019 | 15.0.0-15.0.1.1; 14.1.0-14.1.2; 14.0.0-14.0.1; 13.1.0-13.1.3.1; 12.1.0-12.1.5; 11.5.2-11.6.5.1 | No fixed version is explicitly recorded in the structured CVE data. | Use CVE record |
| CVE-2019-6609 | 15 Apr 2019 | 14.0.0-14.1.0.1; 13.0.0-13.1.1.3; 12.1.1 HF2-12.1.4 | No fixed version is explicitly recorded in the structured CVE data. | Use CVE record |
How this record is maintained
The CVE inventory is reconciled automatically from cve.blacktree.nl. Exact identity matches link to existing Lifecycle product or package histories. Unmatched products stay in a prioritised publisher-source research queue, and Lifecycle marks the date gap instead of inferring a support boundary from vulnerability data.