The latest in a series of cybersecurity issues
While these three vulnerabilities are not known to be exploited in the wild, F5 has repeatedly borne the brunt of cyberattacks in recent years, which is troubling because the cybersecurity and app delivery networking (ADN) company serves tens of thousands of customers, including 80% of the Fortune 500, analysts noted.
Threat actors have repeatedly targeted flaws in its systems and products to map internal servers, hijack devices, breach systems, steal sensitive documents, and deploy data-wiping malware. Over the last five years, the US Cybersecurity and Infrastructure Security Agency (CISA) has flagged eight actively-exploited F5 vulnerabilities; four of these have been targeted in ransomware attacks.
For instance, a 2025 nation-state breach and CISA’s Emergency Directive 26-01 centered on F5’s BIG-IP, and F5 said at the time that NGINX source code was not accessed. But, Dickson noted, NGINX’s own “warning shot” came in May when CVE-2026-42945, a rewrite module overflow nicknamed NGINX Rift, arrived with a public remote code execution proof of concept.
