erroneo.us
Search all guides⌘K

Security Digest · Oct 15, 2025 · Breach · Network edge

F5 Breach: Nation-State Stole BIG-IP Source Code

Attackers stole BIG-IP source code and undisclosed bug data from F5; CISA issued ED 26-01. Two BIG-IP APM RCEs are now in KEV. BIG-IP owners: stay patched.

Published By erroneo.us Security Desk · Updated 3 min read6 sources

Our verdict

Patch this week

The breach itself needs no new action a year on, but its aftermath does: two unauthenticated BIG-IP APM RCEs are now on CISA's exploited list, so every BIG-IP owner should be on current fixed builds with management interfaces off the internet.

Who must act: Anyone running BIG-IP (especially with APM access policies or APM as an OAuth authorization server), F5OS, BIG-IQ or end-of-support F5 hardware.

Who can relax: Organizations with no F5 products, and NGINX or F5 Distributed Cloud users, whose source code F5 says was not taken.

Affected
BIG-IP (TMOS), F5OS, BIG-IQ, BIG-IP Next, BIG-IP Next for Kubernetes/CNF builds older than the October 2025 Quarterly Security Notification fixes
BIG-IP APM builds vulnerable to CVE-2025-53521 (see F5 K000156741)
BIG-IP APM configured as an OAuth Authorization Server, vulnerable to CVE-2026-94127 (see F5 K000162605)
Fixed in
Current fixed builds listed in F5 K000156741 (CVE-2025-53521) and K000162605 (CVE-2026-94127)
CVSS
9.8 (v3.1, CNA)
EPSS
2.3% (percentile 83)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory every BIG-IP, F5OS, BIG-IQ and BNK/CNF instance, physical and virtual
  2. Confirm no management interface (TMUI/SSH) is reachable from the internet
  3. Upgrade to the fixed builds in F5 K000156741 and K000162605; apply F5's iRule mitigation for CVE-2026-94127 only as a stopgap
  4. Decommission public-facing F5 devices that have reached end of support
  5. Stream BIG-IP logs to a SIEM or remote syslog and alert on admin logins
  6. Run F5's threat hunting guide and iHealth checks on any internet-exposed device

How to check if you are affected or compromised

  • Review whether any BIG-IP management interface was internet-reachable since August 2025; if so, perform a compromise assessment
  • Hunt APM virtual servers for crashes, unexpected processes or new files around the dates the APM CVEs entered KEV (Mar 27 and Sep 22, 2026)
  • Check remote syslog for unexpected admin logins and configuration changes

What happened#

On October 15, 2025, F5 disclosed that a nation-state threat actor had maintained long-term access to its BIG-IP product development environment and engineering knowledge management platform. F5 first learned of the intrusion on August 9, 2025, and the U.S. Department of Justice allowed it to delay public disclosure on national security grounds, according to BleepingComputer's report on F5's filing and notice (F5 advisory K000154696).

The attackers took portions of BIG-IP source code, information about undisclosed vulnerabilities F5 was working on, and configuration or implementation details for a limited number of customers. F5 said its CRM, financial, support case and iHealth systems were not compromised, that NGINX and Distributed Cloud source code was not taken, and that independent reviews (NCC Group, IOActive, with CrowdStrike and Mandiant involved) found no tampering with its build or release pipeline. F5 rotated its code-signing certificates and keys. The actor was not publicly named in F5's disclosure.

The same day, CISA issued Emergency Directive 26-01, calling the theft an imminent threat to federal networks, and F5 shipped its October 2025 Quarterly Security Notification, which Tenable counted at 44 unique CVEs across BIG-IP, F5OS and BIG-IP Next.

Who is affected#

Any organization running BIG-IP (TMOS), F5OS, BIG-IQ, BIG-IP Next, BIG-IP Next for Kubernetes/CNF, or BIG-IP iSeries/rSeries hardware. F5 has about 23,000 customers, including 48 of the Fortune 50.

The aftermath is what matters now. CVE-2025-53521, published on breach day, is now described as an RCE in BIG-IP APM when an access policy is configured on a virtual server (CVSS 3.1 9.8 from F5). It entered the CISA KEV catalog on March 27, 2026. A second APM flaw, CVE-2026-94127, is an unauthenticated RCE when APM acts as an OAuth Authorization Server; it entered KEV on September 22, 2026. Whether either exploit was built from the stolen material has not been confirmed by F5 or CISA as of October 21, 2026.

Do you really need to act?#

If you own BIG-IP, yes, but on a normal urgent-patch footing rather than in panic. F5 stated at disclosure that it had no knowledge of undisclosed critical or RCE flaws and no evidence that the stolen vulnerability data had been used. A year later, the concrete risk is the two KEV-listed APM bugs, both reachable on the data plane without authentication when their configuration preconditions are met. If you run APM, treat those as act-now. If you only use LTM with management interfaces locked down and current builds, you are in good shape. End-of-support F5 hardware facing the internet is the real liability: it will not get fixes informed by whatever the attacker learned.

What to do now#

  1. Inventory all F5 hardware, virtual editions and BNK/CNF deployments, as ED 26-01 requires of federal agencies.
  2. Confirm no management interface is reachable from the internet; if one was, run a compromise assessment.
  3. Upgrade to the fixed builds in F5 K000156741 and K000162605. CISA notes an F5 iRule can mitigate CVE-2026-94127 temporarily while you preserve forensic evidence.
  4. Disconnect public-facing devices past end of support.
  5. Send BIG-IP events to a SIEM or remote syslog and monitor login attempts, as F5 recommends.

How to tell if you were hit#

F5 provides a threat hunting guide through its support portal, and its iHealth diagnostic tool gained automated checks after the incident. For the APM flaws, check whether your configuration meets the preconditions (APM access policy; OAuth Authorization Server profile), then look for crashes, new files, unexpected processes and unfamiliar admin sessions around and after the KEV dates. F5 customers whose configuration data was in the stolen files were to be contacted directly; if you were, rotate any credentials or secrets present in that configuration.

Timeline#

  • — F5 becomes aware of the intrusion.
  • — DOJ determines a disclosure delay is warranted.
  • — F5 discloses the breach and quarterly fixes; CISA issues ED 26-01.
  • — ED 26-01 deadline for updating F5OS, TMOS, BIG-IQ and BNK/CNF.
  • — CVE-2025-53521 (APM RCE) added to KEV.
  • — CVE-2026-94127 (APM OAuth RCE) published and added to KEV.

Vulnerability records

  • CVE-2025-53521 · KEV 2026-03-27 · When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).
  • CVE-2026-94127 · KEV 2026-09-22 · When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE).

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. CISA — ED 26-01: Mitigate Vulnerabilities in F5 Devices cisa.gov
  2. Tenable — Frequently Asked Questions About The August 2025 F5 Security Incident tenable.com
  3. NVD — CVE-2025-53521 nvd.nist.gov
  4. NVD — CVE-2026-94127 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities catalog (JSON feed) cisa.gov

Coverage and analysis

  1. BleepingComputer — Hackers breach F5 to steal undisclosed BIG-IP flaws, source code bleepingcomputer.com