Skip to content
Exploit Radar Choose my productsProducts My radar
English

Products › Brands

Brand

F5: actively exploited vulnerabilities

8 vulnerabilities in F5 products (BIG-IP) are in CISA’s catalog of exploited vulnerabilities, 1 of them added in the last 90 days. Last added: September 22, 2026.

F5 security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one F5 category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

  • BIG-IP 8 vulnerabilities · ADCs

Name used by CISA: F5. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this F5 list.

  1. Rank 1F5 BIG-IP

    CVE-2026-94127

    Recently addedHunt for compromise (CISA)

    F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

    Added to the catalog less than 30 days ago: ranked by date added.

    Added
    Sep 22, 2026
    CISA deadline
    3 days
    CVSS severity
    9.8 (critical)

  2. Rank 2F5 BIG-IP

    CVE-2025-53521

    F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

    Added in the last 12 months: ranked by severity.

    Added
    Mar 27, 2026
    CISA deadline
    3 days
    CVSS severity
    9.8 (critical)

  3. Rank 3F5 BIG-IP

    CVE-2023-46747

    Ransomware

    F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Oct 31, 2023
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  4. Rank 4F5 BIG-IP

    CVE-2022-1388

    Ransomware

    F5 BIG-IP Missing Authentication Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    May 10, 2022
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  5. Rank 5F5 BIG-IP

    CVE-2021-22991

    F5 BIG-IP Traffic Management Microkernel Buffer Overflow

    Added more than a year ago: ranked by severity.

    Added
    Jan 18, 2022
    CISA deadline
    14 days
    CVSS severity
    9.8 (critical)

  6. Rank 6F5 BIG-IP

    CVE-2020-5902

    Ransomware

    F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Nov 3, 2021
    CISA deadline
    181 days
    CVSS severity
    9.8 (critical)

  7. Rank 7F5 BIG-IP

    CVE-2021-22986

    Ransomware

    F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Nov 3, 2021
    CISA deadline
    14 days
    CVSS severity
    9.8 (critical)

  8. Rank 8F5 BIG-IP

    CVE-2023-46748

    F5 BIG-IP Configuration Utility SQL Injection Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Oct 31, 2023
    CISA deadline
    21 days
    CVSS severity
    8.8 (high)

Follow and verify

Get new F5 vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.