Vendor

F5

8 of 13 F5 CVEs in Patchfirst (62%) are in of vulnerabilities exploited in the wild, 4 of them used by ransomware.

CVEs: 13
In CISA KEV: 862%
Known ransomware use: 4
Median days to KEV: 84; from publication
Latest KEV listing: 22 Sep 2026

Watch F5 Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
BIG-IP In KEV: 3 CVEs: 6
BIG-IP Configuration Utility In KEV: 2 CVEs: 2
BIG-IP and BIG-IQ Centralized Management In KEV: 1 CVEs: 1
BIG-IP APM In KEV: 1 CVEs: 1
BIG-IP Traffic Management Microkernel In KEV: 1 CVEs: 1
F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, PEM, PSM In KEV: 0 CVEs: 1
NGINX Plus In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with F5 CVEs

TechniqueCVEs
T1190Exploit Public-Facing Application CVEs: 7
T1059Command and Scripting Interpreter CVEs: 7
T1133External Remote Services CVEs: 2
T1003OS Credential Dumping CVEs: 1
T1005Data from Local System CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/f5.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are F5 CVEs linked to the technique. Each link’s provenance is on the CVE page.

F5 CVEs

13 CVEs, by priority

CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
F5 · BIG-IPKEVRansomwarePublic exploitCritical · 9.8T1133External Remote Services T1190Exploit Public-Facing Application+5 more · 5 reports
>99.9%Top 0.01%
89.9priority
CVE-2023-46747F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
F5 · BIG-IP Configuration UtilityKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
96.7%Top 0.11%
83.7priority
CVE-2022-1388F5 BIG-IP Missing Authentication Vulnerability
F5 · BIG-IPKEVRansomwarePublic exploitCritical · 9.8T1548Abuse Elevation Control Mechanism
>99.9%Top 0.03%
79.9priority
CVE-2021-22986F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
F5 · BIG-IP and BIG-IQ Centralized ManagementKEVRansomwarePublic exploitCritical · 9.8T1133External Remote Services T1190Exploit Public-Facing Application+3 more
99.9%Top 0.03%
79.9priority
CVE-2026-94127F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
F5 · BIG-IP APMKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
26.6%Top 2%
79.5priority
CVE-2026-42945NGINX ngx_http_rewrite_module vulnerability
F5 · NGINX PlusPublic exploitHigh · 8.1
68.0%Top 0.68%
72.5priority
CVE-2023-46748F5 BIG-IP Configuration Utility SQL Injection Vulnerability
F5 · BIG-IP Configuration UtilityKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
4.3%Top 8.9%
67.4priority
CVE-2022-41800Appliance mode iControl REST vulnerability
F5 · BIG-IPPublic exploitHigh · 8.7
76.9%Top 0.45%
67.1priority
CVE-2025-53521F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
F5 · BIG-IPKEVCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
2.3%Top 17%
66.5priority
CVE-2021-22991F5 BIG-IP Traffic Management Microkernel Buffer Overflow
F5 · BIG-IP Traffic Management MicrokernelKEVCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+1 more
62.4%Top 0.81%
64.7priority
CVE-2022-41622iControl SOAP vulnerability
F5 · BIG-IPPublic exploitHigh · 8.8
92.4%Top 0.18%
32.2priority
CVE-2016-9244A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled…
F5 Networks · F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, PEM, PSMPublic exploit
74.0%Top 0.52%
26.5priority
CVE-2023-22374iControl SOAP vulnerability
F5 · BIG-IPHigh · 7.5
70.8%Top 0.6%
25.8priority