F5 BIG-IP: Mehrere Schwachstellen
WID-SEC-2026-0321 · first 05.02.2026 · updated 05.02.2026 · CVSS 7,5
What it is about
F5 FirePass ist ein SSL-VPN Gateway der F5 Corporation. Die BIG-IP ist eine Netzwerk Appliance auf der die meisten F5 Produkte laufen. Ein Angreifer kann mehrere Schwachstellen in F5 BIG-IP ausnutzen, um Informationen offenzulegen, falsche Informationen darzustellen oder einen Denial of Service zu verursachen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- Informationen offenzulegen
- falsche Informationen darzustellen oder einen Denial of Service zu verursachen
Am I affected?
Affected according to the BSI:
- F5 BIG-IP <17.1.3.1
- F5 BIG-IP APM 17.5.0-17.5.1
- F5 BIG-IP APM 17.1.0-17.1.3
- F5 BIG-IP APM 21.0.0
- F5 BIG-IP APM 16.1.0-16.1.6
- F5 BIG-IP <17.5.1.4
- F5 BIG-IP WAF/ASM <17.1.3
- F5 BIG-IP Container Ingress Services 2.0.0-2.20.1
- F5 BIG-IP Container Ingress Services 1.0.0-1.14.0
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- F5 BIG-IP 17.1.3.1
- F5 BIG-IP 17.5.1.4
- F5 BIG-IP WAF/ASM 17.1.3
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- F5 Security Advisory vom 2026-02-04 my.f5.com
- F5 Security Advisory vom 2026-02-04 my.f5.com
- F5 Security Advisory vom 2026-02-04 my.f5.com
- F5 Security Advisory vom 2026-02-04 my.f5.com
CVE: CVE-2026-20730, CVE-2026-20732, CVE-2026-22548, CVE-2026-22549
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.