High7.2F5

High [CVE-2021-23015] On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x

This high-severity F5 advisory covers CVE-2021-23015 affecting BIG-IP.

CVE-2021-23015 Published May 10, 2021Updated by vendor Jun 17, 2026

CVE-2021-23015

Monitor future F5 CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl REST endpoints.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected versions

15.1.x
14.1.x
13.1.0.8
all versions

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions

15.1.3
14.1.4.2

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation

Upgrade to a fixed release: 15.1.3, 14.1.4.2. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.