← Vulnerability feed

Vulnerability record · CVE-2024-39809 · published 14 August 2024

CVE-2024-39809: F5 big-ip next central manager insufficient session expiration vulnerability

F5 · Big Ip Next Central Manager

The Central Manager user session refresh token does not expire when a user logs out.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

8.9 CVSS 4.0 High EPSS 0.44% · top 64.4% CWE-613 · Insufficient session expiration
8.9CVSS 4.0 base score
0.44%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

The Central Manager user session refresh token does not expire when a user logs out.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://my.f5.com/manage/s/article/K000140111 Vendor Advisory

Track CVE-2024-39809 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2025-41399F5 big-ip access policy manager improper resource shutdown vulnerabilityWhen a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory re…EPSS 0.41%8.7CVE-2025-36504F5 big-ip access policy manager allocation without limits vulnerabilityWhen a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization…EPSS 0.42%7.5CVE-2024-26026F5 big-ip next central manager sql injection vulnerabilityAn SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions which have reached End of Technical Supp…EPSS 7.2%7.5CVE-2024-21793F5 big-ip next central manager sql injection vulnerabilityAn OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions which have reached End of Technical Su…EPSS 7.1%7.4CVE-2024-32049F5 big-ip next central manager vulnerabilityBIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials.  Note: Softwar…EPSS 0.55%7.1CVE-2025-24319F5 big-ip next central manager improper input validation vulnerabilityWhen BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager No…EPSS 0.39%6.9CVE-2025-54500F5 big-ip access policy manager allocation without limits vulnerabilityAn HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams…EPSS 0.50%6.8CVE-2024-33612F5 big-ip next central manager improper certificate validation vulnerabilityAn improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance Provider …EPSS 0.23%

Source: NIST National Vulnerability Database (record CVE-2024-39809), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.