How many CVEs does F5 have?

F5 has 1,039 published CVE records since 2002, including 160 in the last two years.

How many F5 CVEs are in CISA KEV?

Yes — 13 of F5's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which F5 products have the most CVEs?

The F5 products with the most published CVEs are big-ip_access_policy_manager, big-ip application security manager, big-ip advanced firewall manager, big-ip local traffic manager, big-ip policy enforcement manager.

What are the most common weakness types in F5 CVEs?

F5's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-476 (NULL Pointer Dereference), CWE-20 (Improper Input Validation), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).

Are there public exploits for F5 vulnerabilities?

Yes — 68 of F5's CVEs have a known public exploit.

How many critical F5 vulnerabilities are there?

F5 has 84 critical and 576 high-severity CVEs.

What is the average severity of F5 CVEs?

The average CVSS base score across F5's scored CVEs is 7.1.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

1,039 CVEs

13 in CISA KEV

F5 Vulnerabilities

Name: F5 vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for F5.

1,039

Total CVEs

Published

13

In CISA KEV

Exploited in the wild

68

Public exploits

PoC or exploit code

7.1

Avg CVSS

2002–2026

Overview

F5 has 1,039 published CVE records since 2002, of which 13 are in CISA's Known Exploited Vulnerabilities catalog and 68 have a known public exploit. The average CVSS base score across scored CVEs is 7.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting F5 products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on F5's vulnerability posture, as a share of its 1,039 published CVEs.

Average CVSS: 7.1
Critical / high: 64%
Actively exploited (KEV): 1%
Public exploit available: 7%
Patch available: 64%

Severity and exploitation

How the CVSS severity of F5's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical84

High576

Medium366

Low13

In CISA’s Known Exploited Vulnerabilities catalog

13

13 of F5's CVEs are confirmed exploited in the wild.

Public exploits

68

68 of F5's CVEs have a known public exploit available.

Most affected products

The F5 products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in F5 CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish F5 CVE records.

Disclosure activity by year

How many F5 CVEs were published each year.

2019

154

2020

125

2021

86

2022

132

2023

62

2024

52

2025

81

2026

79

Latest F5 CVEs

The most recently disclosed vulnerabilities affecting F5.

NGINX ngx_http_slice_module vulnerability
CWE-908
High · CVSS 8.8
EPSS 0.6%2026-07-15
NGINX Plus ngx_stream_mqtt_filter_module vulnerability
CWE-125
Medium · CVSS 6.3
EPSS 0.3%2026-07-15
NGINX ngx_http_ssi_module vulnerability
CWE-416
High · CVSS 8.3
EPSS 0.4%2026-07-15
NGINX Map directive and Regex matching vulnerability
CWE-122
Critical · CVSS 9.2
EPSS 0.8%2026-07-15
NGINX Agent Vulnerability
CWE-22
Medium · CVSS 5.3
EPSS 0.2%2026-07-15
NGINX Ingress Controller vulnerability
CWE-476
High · CVSS 7.1
EPSS 0.3%2026-07-15
NGINX Ingress Controller vulnerability
CWE-76
High · CVSS 8.7
EPSS 0.3%2026-07-15
BIG-IP HTTP/2 vulnerability
CWE-770
High · CVSS 8.7
EPSS 0.3%2026-07-15
NGINX Gateway Fabric vulnerability
CWE-129
High · CVSS 7.1
EPSS 0.3%2026-06-17
NGINX Gateway Fabric vulnerability
CWE-74
High · CVSS 8.6
EPSS 0.5%2026-06-17
NGINX Gateway Fabric vulnerability
CWE-76
High · CVSS 8.6
EPSS 0.6%2026-06-17
NGINX ngx_http_charset_module vulnerability
CWE-125
Medium · CVSS 6.3
EPSS 0.4%2026-06-17

Track new F5 CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor F5 CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Foxit1,135 CVEs Juniper1,114 CVEs PHPGurukul1,111 CVEs vmware1,095 CVEs MediaTek, Inc.1,053 CVEs nvidia993 CVEs Joomla981 CVEs pypi962 CVEs

Browse all vendors

Frequently asked questions

Common questions about F5 vulnerabilities.

How many CVEs does F5 have?: F5 has 1,039 published CVE records since 2002, including 160 in the last two years.
How many F5 CVEs are in CISA KEV?: Yes — 13 of F5's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which F5 products have the most CVEs?: The F5 products with the most published CVEs are big-ip_access_policy_manager, big-ip application security manager, big-ip advanced firewall manager, big-ip local traffic manager, big-ip policy enforcement manager.
What are the most common weakness types in F5 CVEs?: F5's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-476 (NULL Pointer Dereference), CWE-20 (Improper Input Validation), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).
Are there public exploits for F5 vulnerabilities?: Yes — 68 of F5's CVEs have a known public exploit.
How many critical F5 vulnerabilities are there?: F5 has 84 critical and 576 high-severity CVEs.
What is the average severity of F5 CVEs?: The average CVSS base score across F5's scored CVEs is 7.1.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track F5 vulnerabilities

Monitor new F5 vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing