F5 vulnerabilities under active exploitation

12 CVEs on this page carry evidence of exploitation.

Which F5 vulnerabilities are being exploited?

6 of them are in the CISA KEV catalog.

• CVE-2025-53521 In KEV since 2026-03-27 · EPSS 2% · No fix identified here
• CVE-2026-24061 In KEV since 2026-01-26 · EPSS 98% · No fix identified here
• CVE-2024-38475 In KEV since 2025-05-01 · EPSS 100.0% · No fix identified here
• CVE-2024-36401 In KEV since 2024-07-15 · EPSS 99.8% · No fix identified here
• CVE-2023-32315 In KEV since 2023-08-24 · EPSS 100.0% · No fix identified here
• CVE-2021-26855 In KEV since 2021-11-03 · EPSS 100.0% · Used in ransomware · No fix identified here
• CVE-2025-49844 EPSS 87% · No fix identified here
• CVE-2024-38472 EPSS 69% · No fix identified here
• CVE-2024-38476 EPSS 42% · No fix identified here
• CVE-2024-39573 EPSS 35% · No fix identified here
• CVE-2007-4559 EPSS 27% · No fix identified here
• CVE-2024-38473 EPSS 26% · No fix identified here

Which of them have a fix?

We cannot name a fix for any of them.

For the rest we hold no patch identifier, which is not the same as no patch existing.

What PlainSec published about F5

• NGINX Patch Bundle Includes ASLR-Dependent RCE (2026-07-19)
• Public Exploits Now Feed a Custom Cobalt Strike Loader (2026-06-27)
• Public PoC Turns NGINX Into Active Attack Surface (2026-05-16)

Which F5 products this page tracks

• BIG-IP
• F5
• F5 BIG-IP
• F5 NGINX Plus
• NGINX Plus

KEV and EPSS are re-checked daily. Page last updated 2026-08-16.