Security vendor · WAF and WAAP · in CISA KEV
F5 in the CISA KEV catalog
CISA’s Known Exploited Vulnerabilities catalog lists 8 entries for F5 as of catalog version 2026.11.06, released November 6, 2026. The newest was added September 22, 2026, and the latest federal due date is September 25, 2026. CISA marks 4 of them as known ransomware use.
Updated
- entries in the catalog
- 8
- newest addition
- September 22, 2026
- latest federal due date
- September 25, 2026
- marked known ransomware use
- 4
Directory record
- Website
- www.f5.com
- Categories
- WAF and WAAP (primary), API security
- Headquarters
- Seattle, United States
- Founded
- Not established
- Ownership
- Public (NASDAQ: FFIV)
- Company record
- F5 on CISO Tribune
Directory data as of November 8, 2026. What the company sells, and the source for every fact, is on its CISO Tribune page.
KEV entries, newest first
Filed by CISA under the name “F5”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.
Added September 22, 2026
CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
BIG-IP APM
Due September 25, 2026
Added March 27, 2026
CVE-2025-53521 F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
BIG-IP
Due March 30, 2026
Added October 31, 2023
CVE-2023-46748 F5 BIG-IP Configuration Utility SQL Injection Vulnerability
BIG-IP Configuration Utility
Due November 21, 2023
Added October 31, 2023
CVE-2023-46747 F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
BIG-IP Configuration Utility · known ransomware use
Due November 21, 2023
Added May 10, 2022
CVE-2022-1388 F5 BIG-IP Missing Authentication Vulnerability
BIG-IP · known ransomware use
Due May 31, 2022
Added January 18, 2022
CVE-2021-22991 F5 BIG-IP Traffic Management Microkernel Buffer Overflow
BIG-IP Traffic Management Microkernel
Due February 1, 2022
Added November 3, 2021
CVE-2021-22986 F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
BIG-IP and BIG-IQ Centralized Management · known ransomware use
Due November 17, 2021
Added November 3, 2021
CVE-2020-5902 F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
BIG-IP · known ransomware use
Due May 3, 2022
Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.
On Daily CISO, newest first
Daily briefing · September 27, 2026
Six more exploited flaws on CISA's KEV list, including F5 and SharePointWeekly archive · Oct 13 – Oct 19, 2025
F5 Discloses Nation-State Breach of BIG-IP Development SystemsWeekly archive · Oct 13 – Oct 19, 2025
CISA Issues Emergency Directive 26-01 for F5 DevicesWeekly archive · Apr 21 – Apr 27, 2025
Security Leadership Moves: F5, Palo Alto Networks, VaultreeWeekly archive · Jan 22 – Jan 28, 2024
F5 Names Samir Sherif as Chief Information Security OfficerWeekly archive · Oct 30 – Nov 5, 2023
CISA Adds Two F5 BIG-IP Flaws to Known Exploited Vulnerabilities CatalogWeekly archive · May 16 – May 22, 2022
CISA and MS-ISAC Warn of Active F5 BIG-IP ExploitationWeekly archive · May 9 – May 15, 2022
Exploit attempts follow proof-of-concept code for F5 BIG-IP CVE-2022-1388Weekly archive · May 2 – May 8, 2022
F5 Discloses Critical BIG-IP Authentication Bypass, CVE-2022-1388
Sources
- Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
- Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
- CISO Tribune, vendor directory record for F5, published November 8, 2026