Live monitoring Updated 72-hour alert levelMajor alert Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE

Vendor

F5: actively exploited vulnerabilities

8 vulnerabilities in F5 products are listed in CISA’s catalog of actively exploited vulnerabilities, 4 of them used by ransomware. Latest addition on September 22, 2026: CVE-2026-94127 (BIG-IP APM).

Affected products

  • BIG-IP3
  • BIG-IP Configuration Utility2
  • BIG-IP and BIG-IQ Centralized Management1
  • BIG-IP APM1
  • BIG-IP Traffic Management Microkernel1

CERT-FR alerts and notices

Recent CERT-FR publications naming this vendor (alerts: immediate threat; notices: patches released). In French.

  1. CERTFR-2026-ALE-004

    Vulnérabilité dans F5 BIG-IP Access Policy Manager (31 mars 2026)

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2026 2 vulnerabilities

  1. CVE-2026-94127

    F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

    NVD entryCISA catalog

  2. CVE-2025-53521

    F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

    NVD entryCISA catalog

2023 2 vulnerabilities

  1. CVE-2023-46748

    F5 BIG-IP Configuration Utility SQL Injection Vulnerability

    NVD entryCISA catalog

  2. CVE-2023-46747Used by ransomware

    F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability

    NVD entryCISA catalog

2022 2 vulnerabilities

  1. CVE-2022-1388Used by ransomware

    F5 BIG-IP Missing Authentication Vulnerability

    NVD entryCISA catalog

  2. CVE-2021-22991

    F5 BIG-IP Traffic Management Microkernel Buffer Overflow

    NVD entryCISA catalog

2021 2 vulnerabilities

  1. CVE-2021-22986Used by ransomware

    F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability

    NVD entryCISA catalog

  2. CVE-2020-5902Used by ransomware

    F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

    NVD entryCISA catalog

What to do

If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.

Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.