F5: every exploited CVE on CISA KEV

All 8 F5 bugs attackers are confirmed to be using, with attack scores and free detection rules.

Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

F5 bugs on CISA’s exploited list

2 added in 2026.

4 of 8

remotely exploitable ones have a free VEDAS detection rule

4 don’t yet; see detection gaps.

are linked to ransomware

Every F5 vulnerability the US government has confirmed attackers are using, newest first, with each bug’s EPSS (predicted attack chance) and VEDAS (exploit evidence) scores and any free Nuclei or Suricata detection rule. US federal agencies must fix KEV-listed bugs by a deadline; everyone else should treat the list as “patch first”.

Added	CVE	Product	Bug	EPSS	VEDAS	Detection rule	Ransomware
2026-09-22	CVE-2026-94127	F5 BIG-IP APM	F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability	0.27	0.98	None yet	No
2026-03-27	CVE-2025-53521	F5 BIG-IP	F5 BIG-IP Stack-Based Buffer Overflow Vulnerability	0.02	0.52	None yet	No
2023-10-31	CVE-2023-46748	F5 BIG-IP Configuration Utility	F5 BIG-IP Configuration Utility SQL Injection Vulnerability	0.04	0.52	None yet	No
2023-10-31	CVE-2023-46747	F5 BIG-IP Configuration Utility	F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability	0.97	0.98	Nuclei · Suricata	Yes
2022-05-10	CVE-2022-1388	F5 BIG-IP	F5 BIG-IP Missing Authentication Vulnerability	1.00	0.99	Nuclei · Suricata	Yes
2022-01-18	CVE-2021-22991	F5 BIG-IP Traffic Management Microkernel	F5 BIG-IP Traffic Management Microkernel Buffer Overflow	0.62	0.99	None yet	No
2021-11-03	CVE-2021-22986	F5 BIG-IP and BIG-IQ Centralized Management	F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability	1.00	0.99	Nuclei · Suricata	Yes
2021-11-03	CVE-2020-5902	F5 BIG-IP	F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability	1.00	0.99	Nuclei · Suricata	Yes

Industry partners