CISA KEV + NVD
F5 BIG-IP flaws exploited in the wild
8 F5 BIG-IP vulnerabilities CISA lists as used by attackers, each with when it was published, NVD’s severity score, how many days passed between NVD publication and CISA’s KEV listing, and the vendor’s advisory where CISA links one. Catalog version 2026.10.20.
BIG-IP is an application delivery controller; its APM module terminates remote-access VPN sessions.
In numbers
- 8 exploited flaws, listed from 3 Nov 2021 to 22 Sep 2026
- 4 used in ransomware campaigns
- 7 scored critical by NVD
- 5 days: median gap between NVD publication and the KEV listing, leaving out the 2 listed on the catalog’s first day; 4 were listed within a week
All exploited F5 BIG-IP flaws, newest first
| Vulnerability | Product | Published | Added to KEV | CVSS | Advisory |
|---|---|---|---|---|---|
| CVE-2026-94127F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | BIG-IP APM | 22 Sep 2026 | 22 Sep 2026same day or before NVD | 9.8 Critical | Vendor |
| CVE-2025-53521F5 BIG-IP Stack-Based Buffer Overflow Vulnerability | BIG-IP | 15 Oct 2025 | 27 Mar 2026163 days later | 9.8 Critical | Vendor |
| CVE-2023-46748F5 BIG-IP Configuration Utility SQL Injection Vulnerability | BIG-IP Configuration Utility | 26 Oct 2023 | 31 Oct 20235 days later | 8.8 High | Vendor |
| CVE-2023-46747F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability | BIG-IP Configuration Utility | 26 Oct 2023 | 31 Oct 20235 days laterUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2022-1388F5 BIG-IP Missing Authentication Vulnerability | BIG-IP | 5 May 2022 | 10 May 20225 days laterUsed in ransomware | 9.8 Critical | — |
| CVE-2021-22991F5 BIG-IP Traffic Management Microkernel Buffer Overflow | BIG-IP Traffic Management Microkernel | 31 Mar 2021 | 18 Jan 2022293 days later | 9.8 Critical | — |
| CVE-2021-22986F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability | BIG-IP and BIG-IQ Centralized Management | 31 Mar 2021 | 3 Nov 2021217 days laterUsed in ransomware | 9.8 Critical | — |
| CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | BIG-IP | 1 Jul 2020 | 3 Nov 2021490 days laterUsed in ransomware | 9.8 Critical | — |
What to do
- Match the product and version on your appliance against the vendor advisory linked in the row (where none is shown, use the references on the NVD page), and install the fixed release it names.
- CISA’s required action is to apply the vendor’s updates or mitigations, or stop using the product where none exist; recent entries add CISA’s own hunt or forensic-triage steps, and end-of-life products are to be disconnected. US federal civilian agencies must act by a deadline; everyone else faces the same risk.
- Keep the management interface and the VPN portal off the public internet where you can, and restrict them to known addresses where you cannot.
- A patch does not remove an attacker who got in first. For any flaw on this list, look for the vendor’s or CISA’s guidance on signs of compromise, not just the fix.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. The catalog is re-read every week.
- Scope is the perimeter appliance: firewalls, SSL-VPN and remote-access gateways, and the delivery controllers that terminate remote access. Email gateways, sandboxes, management consoles and endpoint tools from the same vendors are left out.
- Publication date and CVSS score are NVD’s. “Days later” counts from NVD publication to the KEV listing; “same day or before NVD” means CISA listed the flaw no later than NVD published it. The catalog began on 3 Nov 2021, so older flaws listed that day count to the catalog’s start, not to when exploitation was first reported; the medians leave them out.
- “Used in ransomware” is CISA’s own field, set when a ransomware campaign is known to have used the flaw. How the data pages are built.