Vulnerabilities by vendor · updated on every deploy
F5 vulnerabilities: exploited CVEs and our analysis
F5 has 8 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 2 of them added in the last 12 months and 4 known to be used in ransomware campaigns. Below: the analysis Zero Hunt Research published on F5 products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
8
CVEs in CISA KEV
2
Added in the last 12 months
4
Known ransomware use
1
Zero Hunt analyses
Products with the most KEV entries: BIG-IP (3) · BIG-IP Configuration Utility (2) · BIG-IP and BIG-IQ Centralized Management (1) · BIG-IP APM (1) · BIG-IP Traffic Management Microkernel (1)
Our analysis of F5 vulnerabilities
2026-09-26
F5 BIG-IP APM CVE-2026-94127: Unauthenticated RCE Exploited in the WildCVE-2026-94127 is a CVSS 9.8 unauthenticated heap-overflow RCE in the F5 BIG-IP APM OAuth authorization server, exploited in the wild before a patch existed.
All 8 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-09-22 | CVE-2026-94127 | BIG-IP APM F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remot… | 2026-09-25 | Forensic triage | Read → |
| 2026-03-27 | CVE-2025-53521 | BIG-IP F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution. | 2026-03-30 | — | |
| 2023-10-31 | CVE-2023-46748 | BIG-IP Configuration Utility F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system comman… | 2023-11-21 | — | |
| 2023-10-31 | CVE-2023-46747 | BIG-IP Configuration Utility F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-… | 2023-11-21 | Ransomware | — |
| 2022-05-10 | CVE-2022-1388 | BIG-IP F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services. | 2022-05-31 | Ransomware | — |
| 2022-01-18 | CVE-2021-22991 | BIG-IP Traffic Management Microkernel The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls. | 2022-02-01 | — | |
| 2021-11-03 | CVE-2021-22986 | BIG-IP and BIG-IQ Centralized Management F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or… | 2021-11-17 | Ransomware | — |
| 2021-11-03 | CVE-2020-5902 | BIG-IP F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages. | 2022-05-03 | Ransomware | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many F5 vulnerabilities are in the CISA KEV catalog?
8 in catalog version 2026.10.21, the first added on 2021-11-03 and the most recent on 2026-09-22. 2 were added in the last 12 months.
Which F5 products have the most exploited vulnerabilities?
By KEV entries: BIG-IP (3), BIG-IP Configuration Utility (2), BIG-IP and BIG-IQ Centralized Management (1), BIG-IP APM (1), BIG-IP Traffic Management Microkernel (1).
Are F5 vulnerabilities used in ransomware attacks?
CISA marks 4 of the 8 F5 entries as known to be used in ransomware campaigns. The table flags them.
Is the next F5 CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · Progress