Cyber Resilience

CVE-2026-24464

F5 Big-Ip Access Policy Manager 16.1.0 – 16.1.6

Published
13 May 2026
Modified
29 June 2026
Patch / advisory
CVSS Score v4 6.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0089 56th percentile
Risk Priority 29 floored blend · peak EPSS

Summary

CVE-2026-24464 is a medium-severity Path Traversal: '.../...//' (CWE-35) vulnerability in F5 Big-Ip Access Policy Manager. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 44% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cross a security boundary and delete files. Note: Software versions which have reached…

more

End of Technical Support (EoTS) are not evaluated.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-42930Same product: F5 Big-Ip Access Policy Manager
CVE-2025-59483Same product: F5 Big-Ip Access Policy Manager
CVE-2025-54755Same product: F5 Big-Ip Access Policy Manager
CVE-2026-40703Same product: F5 Big-Ip Access Policy Manager
CVE-2026-40699Same product: F5 Big-Ip Access Policy Manager
CVE-2024-45844Same product: F5 Big-Ip Access Policy Manager
CVE-2026-32673Same product: F5 Big-Ip Access Policy Manager
CVE-2025-59481Same product: F5 Big-Ip Access Policy Manager
CVE-2025-61958Same product: F5 Big-Ip Access Policy Manager
CVE-2025-59781Same product: F5 Big-Ip Access Policy Manager

Affected Assets

f5
big-ip access policy manager
21.0.0 · 16.1.0 — 16.1.6 · 17.1.0 — 17.1.3 · 17.5.0 — 17.5.1
f5
big-ip advanced firewall manager
21.0.0 · 16.1.0 — 16.1.6 · 17.1.0 — 17.1.3 · 17.5.0 — 17.5.1
f5
big-ip advanced web application firewall
21.0.0 · 16.1.0 — 16.1.6 · 17.1.0 — 17.1.3 · 17.5.0 — 17.5.1
f5
big-ip analytics
21.0.0 · 16.1.0 — 16.1.6 · 17.1.0 — 17.1.3 · 17.5.0 — 17.5.1
f5
big-ip application acceleration manager
21.0.0 · 16.1.0 — 16.1.6 · 17.1.0 — 17.1.3 · 17.5.0 — 17.5.1
f5
big-ip application security manager
21.0.0 · 16.1.0 — 16.1.6 · 17.1.0 — 17.1.3 · 17.5.0 — 17.5.1
f5
big-ip application visibility and reporting
21.0.0 · 16.1.0 — 16.1.6 · 17.1.0 — 17.1.3 · 17.5.0 — 17.5.1
f5
big-ip automation toolchain
21.0.0 · 16.1.0 — 16.1.6 · 17.1.0 — 17.1.3 · 17.5.0 — 17.5.1
f5
big-ip carrier-grade nat
21.0.0 · 16.1.0 — 16.1.6 · 17.1.0 — 17.1.3 · 17.5.0 — 17.5.1
f5
big-ip container ingress services
21.0.0 · 16.1.0 — 16.1.6 · 17.1.0 — 17.1.3 · 17.5.0 — 17.5.1
+11 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Input validation directly neutralizes path sequences so the traversal cannot be introduced or exploited.

Enforces access authorizations on the resulting pathname, blocking traversal attempts from succeeding.

Enforces information flow rules that stop unauthorized directory escapes via crafted paths.

Least privilege reduces the impact of any successful traversal by limiting accessible resources.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation and path sanitization that neutralize traversal sequences.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development can detect path-traversal flaws before release.

prevents

Secure SDLC mandates input validation and path-handling controls that directly mitigate path traversal.

prevents

Application security requirements include rules for safe file-path construction and canonicalization.

prevents

Secure architecture principles require proper directory restrictions and input sanitization to prevent traversal.

prevents

Secure coding standards explicitly forbid unsafe path concatenation and mandate canonicalization routines.

mitigates

Information access restriction limits file reachability but does not address the input-validation flaw itself.

References