Cyberfeed6 › Vendors › F5
CISA lists 8 F5 vulnerabilities as exploited in real attacks, and 4 of them are known to be used in ransomware campaigns. Most entries concern BIG-IP, BIG-IP Configuration Utility, BIG-IP APM, BIG-IP Traffic Management Microkernel.
Showing the 8 most recently added of 8. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2026-94127F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | BIG-IP APM | 2026-09-22 | Critical (9.8) | No | Vendor notice |
| CVE-2025-53521F5 BIG-IP Stack-Based Buffer Overflow Vulnerability | BIG-IP | 2026-03-27 | Critical (9.8) | No | Vendor notice |
| CVE-2023-46748F5 BIG-IP Configuration Utility SQL Injection Vulnerability | BIG-IP Configuration Utility | 2023-10-31 | High (8.8) | No | Vendor notice |
| CVE-2023-46747F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability | BIG-IP Configuration Utility | 2023-10-31 | Critical (9.8) | Yes | Vendor notice |
| CVE-2022-1388F5 BIG-IP Missing Authentication Vulnerability | BIG-IP | 2022-05-10 | Critical (9.8) | Yes | |
| CVE-2021-22991F5 BIG-IP Traffic Management Microkernel Buffer Overflow | BIG-IP Traffic Management Microkernel | 2022-01-18 | Critical (9.8) | No | |
| CVE-2021-22986F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability | BIG-IP and BIG-IQ Centralized Management | 2021-11-03 | Critical (9.8) | Yes | |
| CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | BIG-IP | 2021-11-03 | Critical (9.8) | Yes |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.