Threat Brief: Nation-State Actor Steals F5 Source Code and Undisclosed Vulnerabilities

On 15 October 2025, F5 disclosed that a nation-state threat actor conducted a long-term compromise, stealing source code from the BIG-IP product family and information about undisclosed vulnerabilities, according to F5. Unit 42 notes that Cortex Xpanse currently identifies over 600,000 F5 Big-IP instances exposed to the internet.

The attackers reportedly maintained access to the product development environment and engineering knowledge management platform, enabling exfiltration of files that included some BIG-IP source code and details of undisclosed vulnerabilities, with F5 stating there is no knowledge of undisclosed critical or remote code vulnerabilities or active exploitation of such flaws.

The article lists three disclosed vulnerabilities with CVSS scores up to 8.8: CVE-2025-53868, CVE-2025-61955, and CVE-2025-57780, and adds that 45 vulnerabilities were disclosed this quarter versus six last quarter. By 16 October, F5 had not seen evidence of data exfiltration from CRM, financial, or iHealth systems, though a small percentage of customers’ configuration information was contained in some exfiltrated files.

Guidance urges organisations to follow F5’s security notifications and to implement mitigation and hardening steps, with Unit 42 offering protection guidance and threat-hunting resources.