ZeusQA
Start free

Known exploited vulnerabilities

F5 vulnerabilities attackers have used

Every F5 vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 8 F5 vulnerabilities as exploited in the wild, 2 of them added in the last 12 months and 4 used in ransomware campaigns. The most recent is CVE-2026-94127, added Sep 22, 2026. BIG-IP has the most entries (3).

In KEV, all time
8
Added, last 12 months
2
Used in ransomware
4
New CVEs this week
0

By product

BIG-IP (3), BIG-IP Configuration Utility (2), BIG-IP and BIG-IQ Centralized Management (1), BIG-IP APM (1), BIG-IP Traffic Management Microkernel (1).

Every F5 entry in CISA KEV

  1. CVE-2026-94127

    Added · due

    F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

    F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.

  2. CVE-2025-53521

    Added · due

    F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

    F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.

  3. CVE-2023-46748

    Added · due

    F5 BIG-IP Configuration Utility SQL Injection Vulnerability

    F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability…

  4. CVE-2023-46747

    RansomwareAdded · due

    F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability

    F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the…

  5. CVE-2022-1388

    RansomwareAdded · due

    F5 BIG-IP Missing Authentication Vulnerability

    F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.

  6. CVE-2021-22991

    Added · due

    F5 BIG-IP Traffic Management Microkernel Buffer Overflow

    The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.

  7. CVE-2021-22986

    RansomwareAdded · due

    F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability

    F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and…

  8. CVE-2020-5902

    RansomwareAdded · due

    F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

    F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works