---
title: "F5 Breach: Nation-State Stole BIG-IP Source Code"
url: https://erroneo.us/security/briefs/f5-big-ip-source-code-breach/
description: "Attackers stole BIG-IP source code and undisclosed bug data from F5; CISA issued ED 26-01. Two BIG-IP APM RCEs are now in KEV. BIG-IP owners: stay patched."
type: security-brief
section: "Security Digest"
date_published: 2025-10-15
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2025-53521", "CVE-2026-94127"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# F5 Breach: Nation-State Stole BIG-IP Source Code

**Verdict: Patch this week.** The breach itself needs no new action a year on, but its aftermath does: two unauthenticated BIG-IP APM RCEs are now on CISA's exploited list, so every BIG-IP owner should be on current fixed builds with management interfaces off the internet.

- **Who must act:** Anyone running BIG-IP (especially with APM access policies or APM as an OAuth authorization server), F5OS, BIG-IQ or end-of-support F5 hardware.
- **Who can relax:** Organizations with no F5 products, and NGINX or F5 Distributed Cloud users, whose source code F5 says was not taken.
- **Affected:** BIG-IP (TMOS), F5OS, BIG-IQ, BIG-IP Next, BIG-IP Next for Kubernetes/CNF builds older than the October 2025 Quarterly Security Notification fixes; BIG-IP APM builds vulnerable to CVE-2025-53521 (see F5 K000156741); BIG-IP APM configured as an OAuth Authorization Server, vulnerable to CVE-2026-94127 (see F5 K000162605)
- **Fixed:** Current fixed builds listed in F5 K000156741 (CVE-2025-53521) and K000162605 (CVE-2026-94127)
- **CVEs:** CVE-2025-53521, CVE-2026-94127
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every BIG-IP, F5OS, BIG-IQ and BNK/CNF instance, physical and virtual
2. Confirm no management interface (TMUI/SSH) is reachable from the internet
3. Upgrade to the fixed builds in F5 K000156741 and K000162605; apply F5's iRule mitigation for CVE-2026-94127 only as a stopgap
4. Decommission public-facing F5 devices that have reached end of support
5. Stream BIG-IP logs to a SIEM or remote syslog and alert on admin logins
6. Run F5's threat hunting guide and iHealth checks on any internet-exposed device

### How to check if you are affected

- Review whether any BIG-IP management interface was internet-reachable since August 2025; if so, perform a compromise assessment
- Hunt APM virtual servers for crashes, unexpected processes or new files around the dates the APM CVEs entered KEV (Mar 27 and Sep 22, 2026)
- Check remote syslog for unexpected admin logins and configuration changes

## What happened

On October 15, 2025, F5 disclosed that a nation-state threat actor had maintained long-term access to its BIG-IP product development environment and engineering knowledge management platform. F5 first learned of the intrusion on August 9, 2025, and the U.S. Department of Justice allowed it to delay public disclosure on national security grounds, according to [BleepingComputer's report](https://bleepingcomputer.com/news/security/hackers-breach-f5-to-steal-undisclosed-big-ip-flaws-source-code) on F5's filing and notice (F5 advisory K000154696).

The attackers took portions of BIG-IP source code, information about undisclosed vulnerabilities F5 was working on, and configuration or implementation details for a limited number of customers. F5 said its CRM, financial, support case and iHealth systems were not compromised, that NGINX and Distributed Cloud source code was not taken, and that independent reviews (NCC Group, IOActive, with CrowdStrike and Mandiant involved) found no tampering with its build or release pipeline. F5 rotated its code-signing certificates and keys. The actor was not publicly named in F5's disclosure.

The same day, CISA issued [Emergency Directive 26-01](https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices), calling the theft an imminent threat to federal networks, and F5 shipped its October 2025 Quarterly Security Notification, which [Tenable counted](https://www.tenable.com/blog/frequently-asked-questions-about-the-august-2025-f5-security-incident) at 44 unique CVEs across BIG-IP, F5OS and BIG-IP Next.

## Who is affected

Any organization running BIG-IP (TMOS), F5OS, BIG-IQ, BIG-IP Next, BIG-IP Next for Kubernetes/CNF, or BIG-IP iSeries/rSeries hardware. F5 has about 23,000 customers, including 48 of the Fortune 50.

The aftermath is what matters now. [CVE-2025-53521](https://nvd.nist.gov/vuln/detail/CVE-2025-53521), published on breach day, is now described as an RCE in BIG-IP APM when an access policy is configured on a virtual server (CVSS 3.1 9.8 from F5). It entered the [CISA KEV catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) on March 27, 2026. A second APM flaw, [CVE-2026-94127](https://nvd.nist.gov/vuln/detail/CVE-2026-94127), is an unauthenticated RCE when APM acts as an OAuth Authorization Server; it entered KEV on September 22, 2026. Whether either exploit was built from the stolen material has not been confirmed by F5 or CISA as of October 21, 2026.

## Do you really need to act?

If you own BIG-IP, yes, but on a normal urgent-patch footing rather than in panic. F5 stated at disclosure that it had no knowledge of undisclosed critical or RCE flaws and no evidence that the stolen vulnerability data had been used. A year later, the concrete risk is the two KEV-listed APM bugs, both reachable on the data plane without authentication when their configuration preconditions are met. If you run APM, treat those as act-now. If you only use LTM with management interfaces locked down and current builds, you are in good shape. End-of-support F5 hardware facing the internet is the real liability: it will not get fixes informed by whatever the attacker learned.

## What to do now

1. Inventory all F5 hardware, virtual editions and BNK/CNF deployments, as ED 26-01 requires of federal agencies.
2. Confirm no management interface is reachable from the internet; if one was, run a compromise assessment.
3. Upgrade to the fixed builds in F5 K000156741 and K000162605. CISA notes an F5 iRule can mitigate CVE-2026-94127 temporarily while you preserve forensic evidence.
4. Disconnect public-facing devices past end of support.
5. Send BIG-IP events to a SIEM or remote syslog and monitor login attempts, as F5 recommends.

## How to tell if you were hit

F5 provides a threat hunting guide through its support portal, and its iHealth diagnostic tool gained automated checks after the incident. For the APM flaws, check whether your configuration meets the preconditions (APM access policy; OAuth Authorization Server profile), then look for crashes, new files, unexpected processes and unfamiliar admin sessions around and after the KEV dates. F5 customers whose configuration data was in the stolen files were to be contacted directly; if you were, rotate any credentials or secrets present in that configuration.

## Timeline

- Aug 9, 2025 — F5 becomes aware of the intrusion.
- Sep 12, 2025 — DOJ determines a disclosure delay is warranted.
- Oct 15, 2025 — F5 discloses the breach and quarterly fixes; CISA issues ED 26-01.
- Oct 22, 2025 — ED 26-01 deadline for updating F5OS, TMOS, BIG-IQ and BNK/CNF.
- Mar 27, 2026 — CVE-2025-53521 (APM RCE) added to KEV.
- Sep 22, 2026 — CVE-2026-94127 (APM OAuth RCE) published and added to KEV.

## Sources

1. [CISA — ED 26-01: Mitigate Vulnerabilities in F5 Devices](https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices)
2. [Tenable — Frequently Asked Questions About The August 2025 F5 Security Incident](https://www.tenable.com/blog/frequently-asked-questions-about-the-august-2025-f5-security-incident)
3. [NVD — CVE-2025-53521](https://nvd.nist.gov/vuln/detail/CVE-2025-53521)
4. [NVD — CVE-2026-94127](https://nvd.nist.gov/vuln/detail/CVE-2026-94127)
5. [CISA — Known Exploited Vulnerabilities catalog (JSON feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
6. [BleepingComputer — Hackers breach F5 to steal undisclosed BIG-IP flaws, source code](https://bleepingcomputer.com/news/security/hackers-breach-f5-to-steal-undisclosed-big-ip-flaws-source-code)

---
Source page: https://erroneo.us/security/briefs/f5-big-ip-source-code-breach/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt