UpHeron
All vulnerabilities

Servers and applications

CVE-2022-26890

On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Session Awareness, and the "Use APM Username and Session ID" option is enabled, undisclosed requests can…

Severity
High 7.5
Published
5 May 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
F5 BIG-IPServers and applications · cpe:a:f5:big-ip_access_policy_manager
  • Version 16.1.2
  • Version 16.1.1
  • Version 16.1.0
  • Version 15.1.5
All 18 release lines
  • Version 13.1.0
  • Version 13.1.1
  • Version 13.1.3
  • Version 13.1.4
  • Version 13.1.5
  • Version 14.1.0
  • Version 14.1.2
  • Version 14.1.3
  • Version 14.1.4
  • Version 15.1.0
  • Version 15.1.1
  • Version 15.1.2
  • Version 15.1.3
  • Version 15.1.4
  • Version 15.1.5
  • Version 16.1.0
  • Version 16.1.1
  • Version 16.1.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-26890
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-26890