Firewalls, VPNs and routers

F5 security incident history

Updated Oct 26, 2026. Data gathered daily from official public sources.

As of Oct 26, 2026, Vendor History found 1 SEC cyber filing and 8 actively exploited security flaws for F5, dated Nov 3, 2021 to Sep 22, 2026. The most recent breach notice or SEC filing was on Oct 15, 2025. Sources checked: the California and Washington Attorney General breach lists, SEC EDGAR (Form 8-K, Item 1.05) and CISA's Known Exploited Vulnerabilities catalog.

Breach notices and SEC cyber filings

1. Oct 15, 2025SEC cyber filing

   F5 filed a Form 8-K with the SEC under Item 1.05, which is used to report a material cybersecurity incident.

   Source: SEC EDGAR

Got a breach letter from F5? What to do when a vendor has a data breach.

Actively exploited security flaws

Flaws in F5 products that CISA lists as exploited by attackers. If you use an affected product, check that it's updated. What a listing means.

1. Sep 22, 2026Exploited flaw

   F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability (CVE-2026-94127). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

2. Mar 27, 2026Exploited flaw

   F5 BIG-IP Stack-Based Buffer Overflow Vulnerability (CVE-2025-53521). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

3. Oct 31, 2023Exploited flaw

   F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability (CVE-2023-46747). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

4. Oct 31, 2023Exploited flaw

   F5 BIG-IP Configuration Utility SQL Injection Vulnerability (CVE-2023-46748). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

5. May 10, 2022Exploited flaw

   F5 BIG-IP Missing Authentication Vulnerability (CVE-2022-1388). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

6. Jan 18, 2022Exploited flaw

   F5 BIG-IP Traffic Management Microkernel Buffer Overflow (CVE-2021-22991). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

7. Nov 3, 2021Exploited flaw

   F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability (CVE-2020-5902). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

8. Nov 3, 2021Exploited flaw

   F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability (CVE-2021-22986). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

We check: California and Washington Attorney General breach notices, SEC cyber incident filings (Form 8-K, Item 1.05) and CISA's catalog of actively exploited security flaws. An empty section means we found nothing in those sources. It does not mean nothing happened. How it works

To cite: Vendor History, "F5 security incident history," vendorhistory.com/vendor/f5, data checked Oct 26, 2026. Free to reuse under CC BY 4.0 with credit to Vendor History.