F5 vulnerabilities under active exploitation

21 CVEs on this page carry evidence of exploitation.

Which F5 vulnerabilities are being exploited?

15 of them are in the CISA KEV catalog.

One was added to KEV in the last 90 days.

• CVE-2026-94127 In KEV since 2026-09-22 · Fix identified
• CVE-2025-53521 In KEV since 2026-03-27 · EPSS 2% · No fix identified here
• CVE-2026-24061 In KEV since 2026-01-26 · EPSS 99% · No fix identified here
• CVE-2025-55182 In KEV since 2025-12-05 · EPSS 99.8% · Used in ransomware · Fix identified
• CVE-2024-38475 In KEV since 2025-05-01 · EPSS 100.0% · Fix identified
• CVE-2024-36401 In KEV since 2024-07-15 · EPSS 99.8% · No fix identified here
• CVE-2024-21762 In KEV since 2024-02-09 · EPSS 83% · Used in ransomware · No fix identified here
• CVE-2023-46747 In KEV since 2023-10-31 · EPSS 97% · Used in ransomware · No fix identified here
• CVE-2023-32315 In KEV since 2023-08-24 · EPSS 100.0% · No fix identified here
• CVE-2023-27997 In KEV since 2023-06-13 · EPSS 86% · Used in ransomware · No fix identified here
• CVE-2022-42475 In KEV since 2022-12-13 · EPSS 99% · Used in ransomware · No fix identified here
• CVE-2022-1388 In KEV since 2022-05-10 · EPSS 100.0% · Used in ransomware · No fix identified here
• CVE-2018-13379 In KEV since 2021-11-03 · EPSS 100.0% · Used in ransomware · No fix identified here
• CVE-2021-26855 In KEV since 2021-11-03 · EPSS 100.0% · Used in ransomware · No fix identified here
• CVE-2021-22986 In KEV since 2021-11-03 · EPSS 99.9% · Used in ransomware · Fix identified
• CVE-2025-49844 EPSS 82% · No fix identified here
• CVE-2024-38472 EPSS 69% · Fix identified
• CVE-2024-38476 EPSS 42% · Fix identified
• CVE-2024-39573 EPSS 37% · Fix identified
• CVE-2007-4559 EPSS 27% · No fix identified here
• CVE-2024-38473 EPSS 26% · Fix identified

Which of them have a fix?

We can name a fix for 8 of them.

For the rest we hold no patch identifier, which is not the same as no patch existing.

What PlainSec published about F5

• Hunt.io Found a Tailored 3BB Intrusion Kit (2026-09-16)
• Tenable and SentinelOne Find Vendor-Level Repeat Pressure (2026-08-27)
• FortiGuard Flags NGINX Heap Overflow in Appliances (2026-08-25)
• NGINX Patch Bundle Includes ASLR-Dependent RCE (2026-07-19)
• HTTP/3 Servers Crash on Ordinary QPACK Traffic (2026-07-11)
• Public Exploits Now Feed a Custom Cobalt Strike Loader (2026-06-27)
• HTTP/2 Defaults Share a Fast Memory-Exhaustion Path (2026-06-05)
• Public PoC Turns NGINX Into Active Attack Surface (2026-05-16)
• Nginx UI’s MCP Endpoint Opens Full Server Takeover (2026-05-02)
• F5 BIG-IP APM Flaw Reclassified as Critical RCE with Active Exploitation (2026-04-26)
• CISA Adds F5 BIG‑IP APM RCE Flaw to KEV (2026-04-01)

Which F5 products this page tracks

• BIG-IP
• F5
• F5 BIG-IP
• F5 NGINX Plus
• NGINX Plus

KEV and EPSS are re-checked daily. Page last updated 2026-10-11.