Vendor dossier / #32
F5 vulnerabilities in CISA KEV
Answer CISA's KEV catalog lists 8 F5 vulnerabilities as of catalog 2026.09.23, 0.5% of all 1,721 entries and rank 32 of 283 vendors. The first was added on 2021-11-03 and the most recent on 2026-09-22; 4 are flagged as used in ransomware campaigns.
- KEV entries
- 80.5% of catalog
- Last 90 days
- +1added
- Ransomware: known
- 450%
- Products
- 5distinct
- First added
- 2021-11-03
- Latest added
- 2026-09-22
- Median days to due
- 17.5
- Open deadlines
- 1federal
TAdditions per quarter
Table view (by year)
| Year | Added |
|---|---|
| 2021 | 2 |
| 2022 | 2 |
| 2023 | 2 |
| 2024 | 0 |
| 2025 | 0 |
| 2026 | 2 |
QCommon questions
How many F5 vulnerabilities are in CISA KEV?
8, as of KEV catalog 2026.09.23 (released 2026-09-23). That is 0.5% of the catalog.
Which F5 product has the most KEV entries?
BIG-IP, with 3 entries. 5 products appear in total.
How many F5 KEV vulnerabilities are linked to ransomware?
4 of 8 (50%) are flagged by CISA as known to be used in ransomware campaigns.
When was the latest F5 vulnerability added to KEV?
2026-09-22 (CVE-2026-94127).
What is the most common weakness in F5 KEV entries?
CWE-122 (Heap-based buffer overflow), listed on 1 entry.
PProducts
| Product | Entries | Share of vendor |
|---|---|---|
| BIG-IP | 3 | 37.5% |
| BIG-IP Configuration Utility | 2 | 25% |
| BIG-IP APM | 1 | 12.5% |
| BIG-IP Traffic Management Microkernel | 1 | 12.5% |
| BIG-IP and BIG-IQ Centralized Management | 1 | 12.5% |
WWeaknesses
| CWE | Entries | Share of vendor |
|---|---|---|
| CWE-122 Heap-based buffer overflow | 1 | 12.5% |
| CWE-121 Stack-based buffer overflow | 1 | 12.5% |
| CWE-89 SQL injection | 1 | 12.5% |
| CWE-288 Authentication bypass via alternate path | 1 | 12.5% |
| CWE-306 Missing authentication | 1 | 12.5% |
| CWE-119 Memory buffer bounds error | 1 | 12.5% |
| CWE-863 Incorrect authorization | 1 | 12.5% |
| CWE-22 Path traversal | 1 | 12.5% |
EAll 8 entries
| CVE | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|
| CVE-2026-94127 | BIG-IP APM | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | New | Open | Unknown | CWE-122 |
| CVE-2025-53521 | BIG-IP | F5 BIG-IP Stack-Based Buffer Overflow Vulnerability | Unknown | CWE-121 | ||
| CVE-2023-46748 | BIG-IP Configuration Utility | F5 BIG-IP Configuration Utility SQL Injection Vulnerability | Unknown | CWE-89 | ||
| CVE-2023-46747 | BIG-IP Configuration Utility | F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability | Known | CWE-288 | ||
| CVE-2022-1388 | BIG-IP | F5 BIG-IP Missing Authentication Vulnerability | Known | CWE-306 | ||
| CVE-2021-22991 | BIG-IP Traffic Management Microkernel | F5 BIG-IP Traffic Management Microkernel Buffer Overflow | Unknown | CWE-119 | ||
| CVE-2021-22986 | BIG-IP and BIG-IQ Centralized Management | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability | Known | CWE-863 | ||
| CVE-2020-5902 | BIG-IP | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | Known | CWE-22 |
Cite this
CISA's Known Exploited Vulnerabilities catalog lists 8 F5 vulnerabilities (0.5% of all entries). Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/vendors/f5/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23. Vendor names are CISA's vendorProject strings; Telemetry states no facts about F5 beyond this data.