F5 BIG-IP APM

Mentions · 7d0
Mentions · 30d1
All mentions5
First seenSep 8, 2026
Last mentioned14d ago

Timeline

5 articles · newest first

Eclypsium report details exploited flaws in firewalls, VPNs and network appliances

InfraTrust tracked 133 new advisories covering 2,813 vulnerabilities in a month; 16 advisories involved actively exploited KEV-listed flaws.

BleepingComputerOct 28, 14:00 UTC · 14d agoExploit / PoCExploitedCVE-2026-88771 CVE-2026-88772 CVE-2026-88779+126 · 1 read

Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances

CISA adds four actively exploited zero-days to KEV, forcing immediate patching of critical flaws in Check Point, Arista, and F5 systems.

Help Net SecuritySep 23, 10:22 UTC · Sep 23, 2026VulnerabilityExploitedCVE-2026-93616 CVE-2026-85102 CVE-2026-93952+13 · 1 read

Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways

Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.

CSO OnlineSep 10, 11:51 UTC · Sep 10, 2026MalwareExploitedCVE-2025-535211 · 1 read

Hackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memory

Sophos analyzed a Linux rootkit, tracked as PoisonedRefresh, on hacked F5 BIG-IP APM devices hiding an in-memory web shell linked to exploited CVE-2025-53521.

Help Net SecuritySep 9, 11:05 UTC · Sep 9, 2026MalwareExploitedCVE-2025-535215 · 1 read

Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit

Sophos analyzed a Linux rootkit on F5 BIG-IP APM devices that injects a fileless PHP web shell, likely after CVE-2025-53521 exploitation.

BleepingComputerSep 8, 20:08 UTC · Sep 8, 2026MalwareExploitedCVE-2025-53521

Related CVEs

by mentions

CVE-2025-535212%9.3
Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE
published Oct 15, 2025F5 BIG-IP (BIG-IP Access Policy Manager / APM)KEV
CVE-2026-9361692%9.8
Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload
published Sep 22, 2026Check Point Management ServerKEVPoC
CVE-2026-939521%9.5
Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem)
published Sep 22, 2026Arista (VeloCloud; formerly VMware/Broadcom) VeloCloud Orchestrator (VCO), on-premisesKEV
CVE-2026-9412727%9.3
Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile
published Sep 22, 2026F5 BIG-IP (Access Policy Manager)KEVPoC ×2
CVE-2026-1042865%9.8
Unauthenticated path traversal file write in Fortinet FortiMail
published Oct 1, 2026Fortinet FortiMailKEVPoC ×4
CVE-2026-765196%9.8
Relative Path Traversal to Root RCE in Cisco Secure Email Gateway
published 28d agoCisco Secure Email GatewayKEVPoC
CVE-2026-8877277%9.5
Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
published Sep 27, 2026Citrix NetScaler ADCKEVPoC ×4
CVE-2026-109618100%9.2
OOM longjmp memory flaw enabling RCE in PHP
published 21d agophpKEVPoC ×25
CVE-2026-03222%8.6
Authenticated root RCE in Palo Alto PAN-OS management
published 28d agoPalo Alto Networks PAN-OS on PA-Series firewallsKEV
CVE-2026-10493589%8.6
Auth Bypass to Command Execution in Ivanti Connect Secure
published 29d agoIvanti Connect SecureKEVPoC ×4

Appears with

F5vendor · 4
Sophosvendor · 3
CISAorganization · 2
Arista VeloCloud Orchestratorproduct · 2
PoisonedRefreshmalware · 2
Sophosorganization · 2
Aristavendor · 2
ESETvendor · 2
F5 Networksvendor · 1
Apachevendor · 1
Apacheproduct · 1
Palo Alto Networksvendor · 1
F5organization · 1
Check Point Spark Firewallsproduct · 1
Fortinetvendor · 1
Ciscovendor · 1

Entities are extracted by the model from each article. First seen Sep 8, 2026, last mentioned 14d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.