https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-24319.htmlhttps://patchthecve.com/cve/CVE-2025-24319.htmlWed, 17 Jun 2026 08:58:33 +0000MEDIUM 6.5: When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.https://patchthecve.com/cve/CVE-2025-23413.htmlhttps://patchthecve.com/cve/CVE-2025-23413.htmlWed, 17 Jun 2026 08:54:10 +0000MEDIUM 4.4: When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.https://patchthecve.com/cve/CVE-2024-41719.htmlhttps://patchthecve.com/cve/CVE-2024-41719.htmlWed, 17 Jun 2026 07:48:07 +0000MEDIUM 4.2: When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credentials will be logged in the BIG-IP Central Manager logs.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.https://patchthecve.com/cve/CVE-2024-39809.htmlhttps://patchthecve.com/cve/CVE-2024-39809.htmlWed, 17 Jun 2026 07:42:50 +0000HIGH 7.5: The Central Manager user session refresh token does not expire when a user logs out.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluatedhttps://patchthecve.com/cve/CVE-2024-37028.htmlhttps://patchthecve.com/cve/CVE-2024-37028.htmlWed, 17 Jun 2026 07:37:37 +0000MEDIUM 5.3: BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.https://patchthecve.com/cve/CVE-2024-33612.htmlhttps://patchthecve.com/cve/CVE-2024-33612.htmlWed, 17 Jun 2026 07:32:05 +0000MEDIUM 6.8: An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance Provider system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.https://patchthecve.com/cve/CVE-2024-32049.htmlhttps://patchthecve.com/cve/CVE-2024-32049.htmlWed, 17 Jun 2026 07:29:10 +0000HIGH 7.4: BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. https://patchthecve.com/cve/CVE-2024-26026.htmlhttps://patchthecve.com/cve/CVE-2024-26026.htmlWed, 17 Jun 2026 07:16:58 +0000HIGH 7.5: An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluatedhttps://patchthecve.com/cve/CVE-2024-21793.htmlhttps://patchthecve.com/cve/CVE-2024-21793.htmlWed, 17 Jun 2026 07:10:10 +0000HIGH 7.5: An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.