On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions…

Description

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Scores

EPSS (exploitation in 30 days)

0.21% · top 89% of all CVEs (4 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

• CWE-732 Incorrect Permission Assignment for Critical Resource (opens in a new tab)All about CWE-732 and its CVEs

Affected products

• F5 · BIG-IP APM

  • affected 12.1.x
  • affected 11.6.x
  • unaffected 17.0.0 – < 17.0.x*
  • affected 16.1.x – < 16.1.2.2
  • affected 15.1.x – < 15.1.5.1
  • affected 14.1.x – < 14.1.4.6
  • affected 13.1.x – < 13.1.5

• F5 · BIG-IP APM Clients

  • affected 7.x – < 7.2.1.5

References (1)

• https://support.f5.com/csp/article/K33552735 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-29263](https://trackcve.app/badge/CVE-2022-29263.svg)](https://trackcve.app/cve/CVE-2022-29263)

Record last updated 8 Oct 2026, 21:24 UTC.