{"meta":{"title":"KEV entries: F5","description":"All KEV entries for vendor F5.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":8,"vendor":"F5","entries":8,"shareOfCatalogPercent":0.5,"ransomwareKnown":4,"firstDateAdded":"2021-11-03","latestDateAdded":"2026-09-22","rank":32},"data":[{"cveID":"CVE-2026-94127","vendorProject":"F5","product":"BIG-IP APM","vulnerabilityName":"F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","dateAdded":"2026-09-22","dueDate":"2026-09-25","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-122"],"shortDescription":"F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"For temporary mitigation to allow for proactive forensic triage, apply the vendor-provided iRule. Once completed, install the final vendor patch as soon as possible. For more information please see: https://my.f5.com/manage/s/article/K000162605 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-94127","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-94127/"},{"cveID":"CVE-2025-53521","vendorProject":"F5","product":"BIG-IP","vulnerabilityName":"F5 BIG-IP Stack-Based Buffer Overflow Vulnerability","dateAdded":"2026-03-27","dueDate":"2026-03-30","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-121"],"shortDescription":"F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Please adhere to F5’s guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible F5 products affected by this vulnerability. For more information please see: https://my.f5.com/manage/s/article/K000156741 ; https://my.f5.com/manage/s/article/K000160486 ; https://my.f5.com/manage/s/article/K11438344 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53521","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2025-53521"},{"cveID":"CVE-2023-46748","vendorProject":"F5","product":"BIG-IP Configuration Utility","vulnerabilityName":"F5 BIG-IP Configuration Utility SQL Injection Vulnerability","dateAdded":"2023-10-31","dueDate":"2023-11-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-89"],"shortDescription":"F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://my.f5.com/manage/s/article/K000137365 ;  https://nvd.nist.gov/vuln/detail/CVE-2023-46748","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-46748"},{"cveID":"CVE-2023-46747","vendorProject":"F5","product":"BIG-IP Configuration Utility","vulnerabilityName":"F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability","dateAdded":"2023-10-31","dueDate":"2023-11-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-288"],"shortDescription":"F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://my.f5.com/manage/s/article/K000137353;   https://nvd.nist.gov/vuln/detail/CVE-2023-46747","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-46747"},{"cveID":"CVE-2022-1388","vendorProject":"F5","product":"BIG-IP","vulnerabilityName":"F5 BIG-IP Missing Authentication Vulnerability","dateAdded":"2022-05-10","dueDate":"2022-05-31","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-1388","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-1388"},{"cveID":"CVE-2021-22991","vendorProject":"F5","product":"BIG-IP Traffic Management Microkernel","vulnerabilityName":"F5 BIG-IP Traffic Management Microkernel Buffer Overflow","dateAdded":"2022-01-18","dueDate":"2022-02-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-22991","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-22991"},{"cveID":"CVE-2021-22986","vendorProject":"F5","product":"BIG-IP and BIG-IQ Centralized Management","vulnerabilityName":"F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-863"],"shortDescription":"F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-22986","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-22986"},{"cveID":"CVE-2020-5902","vendorProject":"F5","product":"BIG-IP","vulnerabilityName":"F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-5902","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-5902"}]}