F5 vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited F5 flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer OverflowExploited since Sep 22, 2026 · CVSS 9.3
• CVE-2025-53521 F5 BIG-IP Stack-Based Buffer OverflowExploited since Mar 27, 2026 · CVSS 9.3
• CVE-2023-46748 F5 BIG-IP Configuration Utility SQL InjectionExploited since Oct 31, 2023 · CVSS 8.8
• CVE-2023-46747 F5 BIG-IP Configuration Utility Authentication BypassExploited since Oct 31, 2023 · ransomware · CVSS 9.8
• CVE-2022-1388 F5 BIG-IP Missing AuthenticationExploited since May 10, 2022 · ransomware · CVSS 9.8
• CVE-2021-22991 F5 BIG-IP Traffic Management Microkernel Buffer OverflowExploited since Jan 18, 2022 · CVSS 9.8
• CVE-2021-22986 F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code ExecutionExploited since Nov 3, 2021 · ransomware · CVSS 9.8
• CVE-2020-5902 F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code ExecutionExploited since Nov 3, 2021 · ransomware · CVSS 9.8

Latest high and critical flaws

• CVE-2026-97629 Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directHigh 8.3 · Oct 14, 2026
• CVE-2026-97205 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module.Critical 9.2 · Oct 14, 2026
• CVE-2026-96615 Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connecHigh 7.1 · Oct 14, 2026
• CVE-2026-94197 An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy oHigh 8.7 · Oct 14, 2026
• CVE-2026-93479 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the mCritical 9.2 · Oct 14, 2026
• CVE-2026-91184 Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbaHigh 8.7 · Oct 14, 2026
• CVE-2026-15176 A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or returnCritical 9.2 · Oct 14, 2026
• CVE-2026-104939 Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress.High 8.7 · Oct 14, 2026
• CVE-2026-101019 Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalizatioHigh 8.3 · Oct 14, 2026
• CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer OverflowExploited · Critical 9.3 · Sep 22, 2026
• CVE-2026-78689 Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method.Critical 9.2 · Sep 2, 2026
• CVE-2026-78222 A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads RespoHigh 8.7 · Sep 2, 2026
• CVE-2026-77180 When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress ControllHigh 8.7 · Sep 2, 2026
• CVE-2026-66842 BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic High 8.7 · Sep 2, 2026
• CVE-2026-66362 Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator coHigh 8.6 · Sep 2, 2026
• CVE-2026-18329 Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and anHigh 8.8 · Sep 2, 2026
• CVE-2026-60005 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module.High 8.8 · Jul 15, 2026
• CVE-2026-59762 When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.High 8.7 · Jul 15, 2026
• CVE-2026-56434 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module.High 8.3 · Jul 15, 2026
• CVE-2026-55723 When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuratiHigh 8.7 · Jul 15, 2026
• CVE-2026-52865 When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or THigh 7.1 · Jul 15, 2026
• CVE-2026-42533 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture vCritical 9.2 · Jul 15, 2026
• CVE-2026-50107 When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration geneHigh 8.6 · Jun 17, 2026
• CVE-2026-32682 When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause thHigh 7.1 · Jun 17, 2026
• CVE-2026-42530 NGINX Open Source has a vulnerability in the ngx_http_v3_module module.Critical 9.2 · Jun 17, 2026