F5 Networks Breached by Nation-State Actor, BIG-IP Source Code and Undisclosed Vulnerabilities Stolen

F5 Networks has disclosed that a highly sophisticated nation-state threat actor infiltrated its internal systems, exfiltrating files from its BIG-IP product development environment and engineering knowledge management platforms, including portions of source code and information on undisclosed vulnerabilities, according to F5.

The company said that in August 2025 the attacker maintained long-term, persistent access and downloaded files from certain F5 systems, and that the affected systems were isolated with containment efforts now in place.

F5 also stressed that none of the disclosed vulnerabilities were critical or actively exploited, and that there was no evidence of access to or exfiltration from its CRM, financial, support, iHealth, or related systems, with the software supply chain remaining uncompromised, a conclusion validated by NCC Group and IOActive.

In response, F5 issued security updates for 44 vulnerabilities affecting BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ and APM clients, and recommended patching as soon as possible, in line with the October 2025 Quarterly Security Notification.

The Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 26-01 directing Federal Civilian Executive Branch agencies to inventory affected BIG-IP products, assess public internet exposure of management interfaces, and apply updates, with patch deadlines of 22 October for some products and 31 October for all other F5 appliances.