Skip to content
Sign in

F5 product

BIG-IP

Alert
No CISA KEV deadline is open. CISA last added a BIG-IP CVE on 27 Mar.

Tracked since 5 Feb · latest article 28 Sep · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 3 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date3

BIG-IP CVEs in CISA KEV with their federal deadlines. None is open.

Exploited BIG-IP CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2025-53521BIG-IP27 MarPassed 30 Mar13
In CISA KEVCVE-2022-1388RansomwareBIG-IP10 MayPassed 31 May1
In CISA KEVCVE-2020-5902RansomwareBIG-IP3 NovPassed 3 May–
Vendor CSV of 8 entries for F5All 8 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds BIG-IP CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’251Q1 ’260Q2 ’260Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20261
Q2 20260
Q3 20260
Q4 20260

Fix listed

8 of 8 CVEs in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2022-1388: 100th percentile, in CISA KEVCVE-2026-94127: 97.9th percentile, in CISA KEVCVE-2025-53521: 83.2th percentile, in CISA KEVCVE-2026-34176: 52.7th percentileCVE-2026-41957: 43.7th percentileCVE-2026-41225: 19.5th percentileCVE-2026-39459: 17.4th percentileCVE-2026-22548: 11.3th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2022-1388100
CVE-2026-9412797.9
CVE-2025-5352183.2
CVE-2026-3417652.7
CVE-2026-4195743.7
CVE-2026-4122519.5
CVE-2026-3945917.4
CVE-2026-2254811.3

Coverage26 articles · all time

The latest 26 articles naming BIG-IP, in the shared story grammar.

Full timeline
Quiet for 5 weekslast report 28 Sep26 articles11 outlets

26 articles from 11 outlets since 5 Feb. Quiet since 28 Sep.

Now5 Feb271121211212115 Sep21211First reportSecurityWeek · 5 Feb, 10:15CISA alert27 Mar, 22:10 · official
  • Thu 5 Feb, 10:15 UTC. SecurityWeek, first report. Cisco, F5 Patch High-Severity Vulnerabilities.
  • Fri 27 Mar, 22:10 UTC. CISA, its first report on the story. CISA Adds CVE-2025-53521 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Sat 28 Mar, 07:07 UTC. CISA. CISA Adds CVE-2025-53521 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Sat 28 Mar, 07:36 UTC. The Hacker News, its first report on the story. CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation. Cites a CVE in CISA KEV.
  • Sat 28 Mar, 08:09 UTC. Security Affairs, its first report on the story. U.S. CISA adds a flaw in F5 BIG-IP AMP to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Mon 30 Mar, 07:23 UTC. SecurityWeek. F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wild. Cites a CVE in CISA KEV.
  • Mon 30 Mar, 12:14 UTC. NCSC, its first report on the story. Vulnerability affecting F5 BIG-IP APM. Cites a CVE in CISA KEV.
  • Mon 30 Mar, 20:13 UTC. Dark Reading, its first report on the story. Fortinet BIG-IP Vulnerability Reclassified as RCE, Under Exploitation. Cites a CVE in CISA KEV.
  • Tue 31 Mar, 09:11 UTC. Infosecurity, its first report on the story. NCSC Urges Immediate Patching of F5 BIG-IP Bug. Cites a CVE in CISA KEV.
  • Wed 1 Apr, 11:40 UTC. SOCRadar, its first report on the story. CVE-2025-53521: F5 BIG-IP APM Flaw Reclassified as Unauthenticated RCE. Cites a CVE in CISA KEV.
  • Mon 6 Apr, 14:18 UTC. Security Affairs. F5 BIGIP APM Servers Exposed as CVE-2025-53521 Actively Exploited. Cites a CVE in CISA KEV.
  • Thu 14 May, 10:57 UTC. SecurityWeek. F5 fixes NGINX heap overflow and iControl REST command injection.
  • Mon 7 Sep, 15:32 UTC. SecurityOnline, its first report on the story. Stealth Linux Rootkit Targets F5 BIG-IP Appliances via RCE. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 09:29 UTC. The Hacker News. F5 BIG-IP Flaw Hid In-Memory Web Shells from Disk Scans. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 09:30 UTC. Security Affairs. Fileless PoisonedRefresh Rootkit Targets F5 BIG-IP APM Systems. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:49 UTC. SecurityWeek. Attackers Exploited Fortinet and F5 Flaws to Target Thai ISP 3BB. Cites a CVE in CISA KEV.
  • Tue 22 Sep, 18:01 UTC. SecurityOnline. F5 Warns Hackers Are Exploiting Critical BIG-IP APM Flaw. Cites a CVE in CISA KEV.
  • Tue 22 Sep, 20:31 UTC. CISA. CISA Warns of Active Attacks Exploiting Critical F5 BIG-IP Flaw. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 07:36 UTC. SecurityWeek. F5 BIG-IP APM zero-day lets attackers execute code remotely. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 09:59 UTC. Rapid7, its first report on the story. F5 BIG-IP Flaw Enables Unauthenticated Remote Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 18:14 UTC. Security Affairs. F5 Patches Exploited BIG-IP Flaw Allowing Unauthenticated Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 21:50 UTC. Security Affairs. CISA Warns of Active Attacks on Check Point and F5 Flaws. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 03:36 UTC. SecurityOnline. Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at Risk. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 03:47 UTC. SecurityOnline. F5 Patches Exploited BIG-IP Zero-Day Enabling Remote Code Execution. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline. Nine Flaws Exploited as Attackers Target Edge Products and WordPress. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. Check Point, its first report on the story. Check Point Warns of Active Exploits and AI-Powered Attacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 26 articles as a list
  1. Thu 5 FebDay 01
    1. Cisco, F5 Patch High-Severity Vulnerabilities10:15 · SecurityWeek · First report

  2. Quiet for 7 weeks

    Fri 27 MarDay 501
    1. CISA Adds CVE-2025-53521 to Known Exploited Vulnerabilities Catalogue22:10 · CISA · official · CISA alert · Picked up again · Known exploited CVE
  3. Sat 28 MarDay 513
    1. CISA Adds CVE-2025-53521 to Known Exploited Vulnerabilities Catalogue07:07 · CISA · official · Known exploited CVE
    2. CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation07:36 · The Hacker News · Known exploited CVE
    3. U.S. CISA adds a flaw in F5 BIG-IP AMP to its Known Exploited Vulnerabilities catalog08:09 · Security Affairs · Known exploited CVE

  4. Quiet for 2 days

    Mon 30 MarDay 533
    1. F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wild07:23 · SecurityWeek · Known exploited CVE
    2. Vulnerability affecting F5 BIG-IP APM12:14 · NCSC · official · Known exploited CVE
    3. Fortinet BIG-IP Vulnerability Reclassified as RCE, Under Exploitation20:13 · Dark Reading · Known exploited CVE
  5. Tue 31 MarDay 541
    1. NCSC Urges Immediate Patching of F5 BIG-IP Bug09:11 · Infosecurity · Known exploited CVE
  6. Wed 1 AprDay 551
    1. CVE-2025-53521: F5 BIG-IP APM Flaw Reclassified as Unauthenticated RCE11:40 · SOCRadar · Known exploited CVE

  7. Quiet for 5 days

    Mon 6 AprDay 601
    1. F5 BIGIP APM Servers Exposed as CVE-2025-53521 Actively Exploited14:18 · Security Affairs · Picked up again · Known exploited CVE

  8. Quiet for 5 weeks

    Thu 14 MayDay 981
    1. F5 fixes NGINX heap overflow and iControl REST command injection10:57 · SecurityWeek · Picked up again

  9. Quiet for 17 weeks

    Mon 7 SepDay 2141
    1. Stealth Linux Rootkit Targets F5 BIG-IP Appliances via RCE15:32 · SecurityOnline · Picked up again · Known exploited CVE

  10. Quiet for 2 days

    Wed 9 SepDay 2162
    1. F5 BIG-IP Flaw Hid In-Memory Web Shells from Disk Scans09:29 · The Hacker News · Known exploited CVE
    2. Fileless PoisonedRefresh Rootkit Targets F5 BIG-IP APM Systems09:30 · Security Affairs · Known exploited CVE

  11. Quiet for 6 days

    Tue 15 SepDay 2221
    1. Attackers Exploited Fortinet and F5 Flaws to Target Thai ISP 3BB13:49 · SecurityWeek · Picked up again · Known exploited CVE

  12. Quiet for 7 days

    Tue 22 SepDay 2292
    1. F5 Warns Hackers Are Exploiting Critical BIG-IP APM Flaw18:01 · SecurityOnline · Picked up again · Known exploited CVE
    2. CISA Warns of Active Attacks Exploiting Critical F5 BIG-IP Flaw20:31 · CISA · official · Known exploited CVE
  13. Wed 23 SepDay 2304
    1. F5 BIG-IP APM zero-day lets attackers execute code remotely07:36 · SecurityWeek · Known exploited CVE
    2. F5 BIG-IP Flaw Enables Unauthenticated Remote Code Execution09:59 · Rapid7 · Known exploited CVE
    3. F5 Patches Exploited BIG-IP Flaw Allowing Unauthenticated Code Execution18:14 · Security Affairs · Known exploited CVE
    4. CISA Warns of Active Attacks on Check Point and F5 Flaws21:50 · Security Affairs · Known exploited CVE
  14. Thu 24 SepDay 2311
    1. Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at Risk03:36 · SecurityOnline · Known exploited CVE
  15. Fri 25 SepDay 2321
    1. F5 Patches Exploited BIG-IP Zero-Day Enabling Remote Code Execution03:47 · SecurityOnline · Known exploited CVE

  16. Quiet for 3 days

    Mon 28 SepDay 2352
    1. Nine Flaws Exploited as Attackers Target Edge Products and WordPress02:30 · SecurityOnline · Picked up again · Known exploited CVE
    2. Check Point Warns of Active Exploits and AI-Powered Attacks14:30 · Check Point · Known exploited CVE

All CVEs in coverage8

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2022-1388Exploited

    F5 BIG-IP Missing Authentication Vulnerability

    9.8Critical99.9% EPSS · 1 article
  • CVE-2026-94127Exploited

    F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

    9.8Critical25% EPSS · 10 articles
  • CVE-2025-53521Exploited

    F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

    9.8Critical2.3% EPSS · 13 articles
  • CVE-2026-34176

    F5 BIG-IP vulnerability

    8.7High0.7% EPSS · 1 article
  • CVE-2026-41957

    F5 BIG-IP vulnerability

    8.8High0.5% EPSS · 1 article
  • CVE-2026-41225

    F5 BIG-IP vulnerability

    9.1Critical0.3% EPSS · 1 article
  • CVE-2026-39459

    F5 BIG-IP vulnerability

    8.6High0.3% EPSS · 1 article
  • CVE-2026-22548

    BIG-IP Advanced WAF and ASM vulnerability

    Not scored0.2% EPSS · 1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in