Big Ip Advanced Web Application Firewall
Vendor:
First CVE: Jul 1, 2020 · Active for 6 years
194
Total CVEs
More Total CVEs than 100% of tracked products
27.7
Avg CVEs / Year
Higher CVE frequency than 99% of tracked products
7.1
Avg CVSS
Higher Avg CVSS than 46% of tracked products
3.1%
KEV Rate
Higher KEV Rate than 98% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Big Ip Advanced Web Application Firewall over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 1, 2020
6 years ago
Most Recent CVE
May 13, 2026
76 days ago
CVE Severity & Scoring
Big Ip Advanced Web Application Firewall194 CVEs
32%
61%
All CVEs353,240 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local8 (4.1%)
Network184 (94.8%)
Unknown0 (0.0%)
Physical1 (0.5%)
Adjacent Network1 (0.5%)
Attack Complexity
Low183 (94.3%)
High11 (5.7%)
Unknown0 (0.0%)
User Interaction
None174 (89.7%)
Unknown0 (0.0%)
Required20 (10.3%)
Privileges Required
Low34 (17.5%)
High37 (19.1%)
None123 (63.4%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (194 CVEs).
194 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-22986CRITICAL On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7. | Mar 31, 2021 | 9.8 | 99 | YES | YES |
CVE-2020-5902CRITICAL In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Co | Jul 1, 2020 | 9.8 | 99 | YES | YES |
CVE-2023-46747CRITICAL Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addre | Oct 26, 2023 | 9.8 | 98 | YES | YES |
CVE-2023-44487HIGH The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through | Oct 10, 2023 | 7.5 | 97 | YES | YES |
CVE-2021-22991CRITICAL On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual serve | Mar 31, 2021 | 9.8 | 90 | YES | NO |
CVE-2021-22992CRITICAL On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTT | Mar 31, 2021 | 9.8 | 71 | NO | NO |
CVE-2023-46748HIGH An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which
may allow an authenticated attacker with network access to the Configuration utility | Oct 26, 2023 | 8.8 | 69 | YES | NO |
CVE-2025-31644HIGH When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attac | May 7, 2025 | 8.7 | 43 | NO | NO |
CVE-2002-20001HIGH The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-s | Nov 11, 2021 | 7.5 | 38 | NO | NO |
CVE-2021-22987CRITICAL On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3 when running in | Mar 31, 2021 | 9.9 | 36 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (194 CVEs).
CISA KEV
6 CVEs
3.1% of CVEs· 98th percentile
Metasploit
3 CVEs
1.5% of CVEs· 97th percentile
Nuclei
3 CVEs
1.5% of CVEs· 96th percentile
ExploitDB
3 CVEs
1.5% of CVEs· 85th percentile
Social Chatter
Signals from CVEs in this product scope (194 CVEs).
Media Mentions
Signals from CVEs in this product scope (194 CVEs).
Top CNAs Publishing CVEs For Big Ip Advanced Web Application Firewall
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 21.0.0 | 29 | 7.5 | 0.3% | 0 | 0 |
| 17.5.0 | 7 | 7.0 | 3.5% | 0 | 0 |
| 17.1.0 | 11 | 6.9 | 9.5% | 1 | 1 |
| 17.0.0 | 3 | 7.5 | 0.7% | 0 | 0 |
| 16.1.2 | 5 | 6.8 | 0.9% | 0 | 0 |
| 16.1.1 | 4 | 7.2 | 0.9% | 0 | 0 |
| 16.1.0 | 4 | 7.2 | 0.9% | 0 | 0 |
| 16.0.1.1 | 1 | 5.3 | 1.6% | 0 | 0 |
| 16.0.1 | 1 | 7.5 | 0.9% | 0 | 0 |
| 15.1.5 | 4 | 7.2 | 0.9% | 0 | 0 |
| 15.1.4.1 | 1 | 5.3 | 0.6% | 0 | 0 |
| 15.1.4 | 4 | 7.2 | 0.9% | 0 | 0 |
| 15.1.3 | 4 | 7.2 | 0.9% | 0 | 0 |
| 15.1.2 | 4 | 7.2 | 0.9% | 0 | 0 |
| 15.1.1 | 4 | 7.2 | 0.9% | 0 | 0 |
| 15.1.0 | 5 | 7.0 | 0.8% | 0 | 0 |
| 14.1.5 | 1 | 5.3 | 0.6% | 0 | 0 |
| 14.1.4 | 5 | 6.8 | 1.1% | 0 | 0 |
| 14.1.3 | 4 | 7.2 | 0.9% | 0 | 0 |
| 14.1.2 | 4 | 7.2 | 0.9% | 0 | 0 |