F5 — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for F5 with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 8 F5 vulnerabilities confirmed as exploited in the wild across 5 products; 4 of them (50%) are flagged as used in known ransomware campaigns. BIG-IP is the most-affected product, with 3 entries (38% of the total). CISA added 2 entries in 2026 so far, compared with 0 in 2025. Across the 8 entries with an NVD CVSS score (100% of the total), the average score is 9.7; 7 entries are rated critical by NVD. The most recent addition is CVE-2026-94127 (F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability), added on 2026-09-22.
Affected products
| Product | Entries | Share |
|---|---|---|
| BIG-IP | 3 | 38% |
| BIG-IP Configuration Utility | 2 | 25% |
| BIG-IP APM | 1 | 13% |
| BIG-IP Traffic Management Microkernel | 1 | 13% |
| BIG-IP and BIG-IQ Centralized Management | 1 | 13% |
Entries added per year
By date added to the KEV catalog
Exploited F5 vulnerabilities (8)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2026-94127 | BIG-IP APM | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | 2026-09-22 | — | CRITICAL9.8 |
| CVE-2025-53521 | BIG-IP | F5 BIG-IP Stack-Based Buffer Overflow Vulnerability | 2026-03-27 | — | CRITICAL9.8 |
| CVE-2023-46748 | BIG-IP Configuration Utility | F5 BIG-IP Configuration Utility SQL Injection Vulnerability | 2023-10-31 | — | HIGH8.8 |
| CVE-2023-46747 | BIG-IP Configuration Utility | F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability | 2023-10-31 | Known | CRITICAL9.8 |
| CVE-2022-1388 | BIG-IP | F5 BIG-IP Missing Authentication Vulnerability | 2022-05-10 | Known | CRITICAL9.8 |
| CVE-2021-22991 | BIG-IP Traffic Management Microkernel | F5 BIG-IP Traffic Management Microkernel Buffer Overflow | 2022-01-18 | — | CRITICAL9.8 |
| CVE-2020-5902 | BIG-IP | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability | 2021-11-03 | Known | CRITICAL9.8 |
| CVE-2021-22986 | BIG-IP and BIG-IQ Centralized Management | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability | 2021-11-03 | Known | CRITICAL9.8 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.