Vulnerabilities in F5 BIG-IP's iControl REST and TMUI management interfaces — application-delivery controllers whose compromise typically hands attackers control of the load-balanced traffic behind them. Combined article + CVE feed for the F5 beat.https://0daynews.com/en-ushttps://0daynews.com/cve/cve-2020-5902/https://0daynews.com/cve/cve-2020-5902/F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.Fri, 14 Aug 2026 00:00:00 GMTF5criticalcvehttps://0daynews.com/cve/cve-2021-22986/https://0daynews.com/cve/cve-2021-22986/F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.Fri, 14 Aug 2026 00:00:00 GMTF5criticalcvehttps://0daynews.com/cve/cve-2021-22991/https://0daynews.com/cve/cve-2021-22991/The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.Fri, 14 Aug 2026 00:00:00 GMTF5criticalcvehttps://0daynews.com/cve/cve-2022-1388/https://0daynews.com/cve/cve-2022-1388/An authentication-bypass vulnerability in the F5 BIG-IP iControl REST API allows an unauthenticated attacker with network access to the management interface or self-IP addresses to execute arbitrary system commands, create or delete files, or disable services.Fri, 14 Aug 2026 00:00:00 GMTF5criticalcvehttps://0daynews.com/cve/cve-2023-46747/https://0daynews.com/cve/cve-2023-46747/F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.Fri, 14 Aug 2026 00:00:00 GMTF5criticalcvehttps://0daynews.com/cve/cve-2023-46748/https://0daynews.com/cve/cve-2023-46748/F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.Fri, 14 Aug 2026 00:00:00 GMTF5highcvehttps://0daynews.com/cve/cve-2025-53521/https://0daynews.com/cve/cve-2025-53521/F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.Fri, 14 Aug 2026 00:00:00 GMTF5criticalcvehttps://0daynews.com/cve/cve-2026-42533/https://0daynews.com/cve/cve-2026-42533/A heap buffer overflow in the nginx worker process when a map directive's string expression references its regex capture variables before the output variable. Reachable via crafted HTTP; DoS by worker restart, code execution possible only where ASLR is disabled or bypassable.Fri, 14 Aug 2026 00:00:00 GMTF5highcvehttps://0daynews.com/articles/2026-07-02-f5-big-ip-icontrol-rest-auth-bypass/https://0daynews.com/articles/2026-07-02-f5-big-ip-icontrol-rest-auth-bypass/A critical authentication-bypass flaw in F5 BIG-IP's iControl REST API let unauthenticated attackers execute system commands on appliances that front an enormous share of enterprise application traffic.Thu, 02 Jul 2026 15:00:00 GMTF5article