F5 BIG-IP

The US cybersecurity agency CISA lists these vulnerabilities in its catalog of Known Exploited Vulnerabilities. What CISA does not carry does not appear in this list — even where it is being exploited.

• CVE-2021-22986F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 17 Nov 21

• CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 3 May 22

• CVE-2022-1388F5 BIG-IP Missing Authentication VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 31 May 22

• CVE-2023-46747F5 BIG-IP Configuration Utility Authentication Bypass VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 21 Nov 23

• CVE-2021-22991F5 BIG-IP Traffic Management Microkernel Buffer Overflow

  9.8 critical · over the network, without login · CISA deadline was 1 Feb 22

• CVE-2025-53521F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 30 Mar

• CVE-2023-46748F5 BIG-IP Configuration Utility SQL Injection Vulnerability

  8.8 high · over the network, with a basic account · CISA deadline was 21 Nov 23

Source: CISA KEV. The CVE is matched to the product automatically — when in doubt, the linked NVD entry applies.