F5
8 F5 flaws are on CISA's list of vulnerabilities attackers have used, 2 of them added in 2026. CISA says 4 are known to be used by ransomware. The latest was added Sep 22, 2026.
8on CISA's list, all time
2added in 2026
1in the last 90 days
4used by ransomware
4zero-days, all time
Exploited flaws added each year
Most-hit products
| Product | Exploited flaws | Most recent |
|---|---|---|
| BIG-IP | 3 | Mar 27, 2026 |
| BIG-IP Configuration Utility | 2 | Oct 31, 2023 |
| BIG-IP APM | 1 | Sep 22, 2026 |
| BIG-IP Traffic Management Microkernel | 1 | Jan 18, 2022 |
| BIG-IP and BIG-IQ Centralized Management | 1 | Nov 3, 2021 |
Latest F5 flaws
- BIG-IP APMF5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
- BIG-IPF5 BIG-IP Stack-Based Buffer Overflow Vulnerability
- BIG-IP Configuration UtilityF5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
- BIG-IP Configuration UtilityF5 BIG-IP Configuration Utility SQL Injection Vulnerability
- BIG-IPF5 BIG-IP Missing Authentication Vulnerability
- BIG-IP Traffic Management MicrokernelF5 BIG-IP Traffic Management Microkernel Buffer Overflow
- BIG-IPF5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
- BIG-IP and BIG-IQ Centralized ManagementF5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
Counts come from CISA's Known Exploited Vulnerabilities catalog, which lists flaws with reliable evidence of real attacks. A higher count often reflects how widely a vendor's products are used and targeted, not only how secure they are.