en
F5 is a multinational application delivery and cybersecurity company. It develops products and services that help organizations deliver, secure, scale, and manage applications and APIs across data centers, cloud environments, edge locations, and Kubernetes platforms. Its portfolio includes the BIG-IP and NGINX product families and related management and security services.
As of 09/13/2026, F5 recorded 21 security vulnerabilities in the last 90 days across 12 products, including 17 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, NGINX Open Source had the most security vulnerabilities in the F5 ecosystem, with 6 vulnerabilities—approximately 28.57% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-78222NGINX ngx_http_js_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX JavaScript | Published09/02/2026 | SeverityHigh |
CVE-2026-78689NGINX ngx_http_js_module vulnerablility | Exploitation statusNot known exploited | FixYes | Affected productNGINX JavaScript | Published09/02/2026 | SeverityCritical |
CVE-2026-77180NGINX Ingress Controller vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Ingress Controller | Published09/02/2026 | SeverityHigh |
CVE-2026-66362NGF vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Gateway Fabric | Published09/02/2026 | SeverityHigh |
CVE-2026-18329NGINX ngx_http_js_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX JavaScript | Published09/02/2026 | SeverityHigh |
CVE-2026-66842BIG-IP and BIG-IQ Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published09/02/2026 | SeverityHigh |
CVE-2026-63020BIG-IP Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published09/02/2026 | SeverityLow |
CVE-2026-60005NGINX ngx_http_slice_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Plus | Published07/15/2026 | SeverityHigh |
CVE-2026-60065NGINX Plus ngx_stream_mqtt_filter_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Plus | Published07/15/2026 | SeverityMedium |
CVE-2026-56434NGINX ngx_http_ssi_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Plus | Published07/15/2026 | SeverityHigh |
CVE-2026-42533NGINX Map directive and Regex matching vulnerability | Exploitation statusPublic exploit | FixYes | Affected productNGINX Plus | Published07/15/2026 | SeverityCritical |
CVE-2026-60062NGINX Agent Vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Agent | Published07/15/2026 | SeverityMedium |
CVE-2026-52865NGINX Ingress Controller vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Ingress Controller | Published07/15/2026 | SeverityHigh |
CVE-2026-55723NGINX Ingress Controller vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Ingress Controller | Published07/15/2026 | SeverityHigh |
CVE-2026-59762BIG-IP HTTP/2 vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published07/15/2026 | SeverityHigh |
CVE-2026-32682NGINX Gateway Fabric vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Gateway Fabric | Published06/17/2026 | SeverityHigh |
CVE-2026-50107NGINX Gateway Fabric vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Gateway Fabric | Published06/17/2026 | SeverityHigh |
CVE-2026-11311NGINX Gateway Fabric vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Gateway Fabric | Published06/17/2026 | SeverityHigh |
CVE-2026-48142NGINX ngx_http_charset_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Open Source | Published06/17/2026 | SeverityMedium |
CVE-2026-42055NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Open Source | Published06/17/2026 | SeverityCritical |
CVE-2026-42530NGINX Open-Source ngx_http_v3_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Open Source | Published06/17/2026 | SeverityCritical |
CVE-2026-49975Apache HTTP Server: mod_http2 denial of service | Exploitation statusPublic exploit | FixYes | Affected productApache HTTP Server | Published06/08/2026 | SeverityHigh |
CVE-2026-9256NGINX ngx_http_rewrite_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Plus | Published05/22/2026 | SeverityCritical |
CVE-2026-8711NGINX JavaScript vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX JavaScript | Published05/19/2026 | SeverityCritical |
CVE-2026-42926NGINX ngx_http_proxy_v2_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Open Source | Published05/13/2026 | SeverityMedium |
CVE-2026-40460NGINX ngx_quic_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Plus | Published05/13/2026 | SeverityMedium |
CVE-2026-42946NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Plus | Published05/13/2026 | SeverityHigh |
CVE-2026-42934NGINX ngx_http_charset_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Plus | Published05/13/2026 | SeverityMedium |
CVE-2026-42945NGINX ngx_http_rewrite_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Plus | Published05/13/2026 | SeverityCritical |
CVE-2026-40701NGINX ngx_http_ssl_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Plus | Published05/13/2026 | SeverityMedium |
CVE-2026-40423BIG-IP SIP profile vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-42930Appliance mode iControl REST vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-24464Appliance mode iControl REST vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityMedium |
CVE-2026-39458BIG-IP DNS Cache vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-41959iControl and tmsh REST vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-42406BIG-IP and BIG-IQ privilege escalation vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-42058BIG-IP iControl REST vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityMedium |
CVE-2026-32643BIG-IP and BIG-IQ privilege escalation vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-42937iControl REST and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-39455BIG-IP Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-32673BIG-IP scripted monitor vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-41217BIG-IP tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-34176Knowledge Appliance mode iControl REST vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-42063iControl SOAP vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityMedium |
CVE-2026-41225iControl REST vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-39459iControl REST and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-41953BIG-IP Privilege Escalation vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-40631BIG-IP iControl SOAP vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-40698iControl REST and TMSH vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-42924BIG-IP iControl SOAP vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-40060BIG-IP Advanced WAF and ASM vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-42409BIG-IP HTTP/2 vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-41227BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-40061iControl REST and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-35062iControl SOAP vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-40618BIG-IP SSL/TLS vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-41956BIG-IP TMM Vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-42920BIG-IP DTLS Vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-40629BIG-IP SSL/TLS vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-42919F5 BIG-IP Appliance Mode Vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-41218BIG-IP PEM iRules vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-42781BIG-IP FastL4 virtual server vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-20916BIG-IQ iControl REST vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IQ | Published05/13/2026 | SeverityHigh |
CVE-2026-41957BIG-IP and BIG-IQ Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-42408BIG-IP DNS tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityMedium |
CVE-2026-40067BIG-IP APM Vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-40699BIG-IP Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-34019BIG-IP BFD vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityMedium |
CVE-2026-42780BIG-IP SSL Orchestrator vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityMedium |
CVE-2026-41219BIG-IP QKView vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-40462iControl REST and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityHigh |
CVE-2026-28758BIG-IP iControl REST vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityMedium |
CVE-2026-41954iControl REST and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityMedium |
CVE-2026-40435BIG-IP httpd access control vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityMedium |
CVE-2026-40703BIG-IP Configuration utility CSRF vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published05/13/2026 | SeverityMedium |
CVE-2026-27651NGINX ngx_mail_auth_http_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Open Source | Published03/24/2026 | SeverityHigh |
CVE-2026-27654NGINX ngx_http_dav_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Open Source | Published03/24/2026 | SeverityHigh |
CVE-2026-28755NGINX ngx_stream_ssl_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Open Source | Published03/24/2026 | SeverityMedium |
CVE-2026-28753NGINX ngx_mail_proxy_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Open Source | Published03/24/2026 | SeverityMedium |
CVE-2026-32647NGINX ngx_http_mp4_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Open Source | Published03/24/2026 | SeverityHigh |
CVE-2026-27784NGINX ngx_http_mp4_module vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Open Source | Published03/24/2026 | SeverityHigh |
CVE-2026-2507BIG-IP TMM Vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published02/18/2026 | SeverityHigh |
CVE-2026-22549BIG-IP Container Ingress Services vulnerability | Exploitation statusNot known exploited | FixYes | Affected productF5 BIG-IP Container Ingress Services | Published02/04/2026 | SeverityMedium |
CVE-2026-1642NGINX vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Open Source | Published02/04/2026 | SeverityHigh |
CVE-2026-22548BIG-IP Advanced WAF and ASM vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published02/04/2026 | SeverityHigh |
CVE-2026-20732BIG-IP Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published02/04/2026 | SeverityLow |
CVE-2026-20730BIG-IP Edge Client for Windows vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP Edge Client | Published02/04/2026 | SeverityLow |
CVE-2025-14727NGINX Ingress Controller vulnerability | Exploitation statusNot known exploited | FixYes | Affected productNGINX Ingress Controller | Published12/17/2025 | SeverityHigh |
CVE-2025-61990TMM vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published10/15/2025 | SeverityHigh |
CVE-2025-57780F5OS Vulnerability | Exploitation statusNot known exploited | FixYes | Affected productF5OS - Appliance | Published10/15/2025 | SeverityHigh |
CVE-2025-61933BIG-IP APM cross-site scripting (XSS) vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published10/15/2025 | SeverityMedium |
CVE-2025-58071BIG-IP IPSec vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published10/15/2025 | SeverityHigh |
CVE-2025-61935BIG-IP Advanced WAF and ASM vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published10/15/2025 | SeverityHigh |
CVE-2025-53860F5OS-A FIPS HSM vulnerability | Exploitation statusNot known exploited | FixYes | Affected productF5OS - Appliance | Published10/15/2025 | SeverityMedium |
CVE-2025-60015F5OS out-of-bounds write vulnerability | Exploitation statusNot known exploited | FixYes | Affected productF5OS - Appliance | Published10/15/2025 | SeverityMedium |
CVE-2025-54755BIG-IP Configuration utility vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published10/15/2025 | SeverityMedium |
CVE-2025-59483BIG-IP Configuration utility and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published10/15/2025 | SeverityHigh |
CVE-2025-61974BIG-IP SSL/TLS vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published10/15/2025 | SeverityHigh |
CVE-2025-59481BIG-IP iControl REST and tmsh vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published10/15/2025 | SeverityHigh |
CVE-2025-61960BIG-IP APM portal access vulnerability | Exploitation statusNot known exploited | FixYes | Affected productBIG-IP | Published10/15/2025 | SeverityHigh |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
