Executive Summary

03/30/2026 Update: F5 has published an advisory increasing the severity of CVE-2025-53521 to 9.8 after the discovery of a threat actor abusing it in the wild to achieve remote code execution (RCE) on a targeted device. CISA confirmed the compromise, adding it to the KEV catalogue. Our advisory for that update can be found here.

On October 15^th, vendor F5 publicly disclosed a security breach impacting their internal environment and resulting in a threat actor exfiltrating sensitive data about their BIG-IP product line. F5 confirmed that stolen data included portions of its Big-IP source code, internal engineering documentation, and sensitive unreleased product vulnerability data. Additionally, the vendor’s knowledge management platform was compromised, which contained sensitive configuration and organizational information “for a small percentage of customers.”

At the time of this advisory, F5 states that there is no evidence their consumer-facing product build or update pipeline was altered or that malicious code was inserted.

As part of their response to this incident, F5 has released software updates and mitigation guidance for the vulnerabilities involved in this incident. Most of the vulnerabilities addressed by F5 relate to Denial of Service (DoS) conditions, which may be exploited by threat actors by sending specifically crafted malicious traffic to subsystems within BIG-IP family appliances with certain exploitable features enabled. However, several of the disclosed vulnerabilities are more impactful than simple DoS and can result in arbitrary code execution or allow an attacker to deploy malicious implants. These vulnerabilities primarily exist in the various management interfaces of F5 appliances and most require authenticated access to enable exploitation. Please refer to the Technical Details section of this advisory for detailed analysis of these vulnerabilities and insight into potential impact.

Due to the nature of the attack and sensitivity of the information stolen, Beazley Security assesses that threat actors possessing this data will use the information as a precursor to conduct targeted attack campaigns and exploitation attempts against internet-facing F5 devices. Beazley Security strongly recommends that organizations with internet facing F5 devices should update devices immediately.

Affected Systems or Products

This incident affects all BIG-IP products including: BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM. F5 has stated that the NGINX development environment was not impacted.

Due to the large amount of internal development and (previously) undisclosed vulnerability data was stolen by the threat actors, F5 released a large amount of software updates across their entire product line.

An exhaustive list of every product fixed product is not in this document, but can be found in F5’s article: K000156572 Quarterly Security Notification (October 2025).

For more detailed analysis of the vulnerabilities disclosed and the potential impact, please review the Technical Details section of this advisory.

Mitigations / Workarounds

Beazley Security strongly recommends that organizations identify all BIG-IP hardware devices, specifically BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients and apply the most currently available patches.

F5 also has standard documentation on best practices for hardening your F5 system to mitigate against attacks in general. That documentation can be found in F5’s article: K53108777 : Hardening your F5 system.

F5 has also made available an iHealth Diagnostic Tool that can automatically run hardening checks for client appliances.

Patches

Currently, F5 is actively working to publish updated firmware and software images for all products mentioned in K000156572 Quarterly Security Notification (October 2025). Refer to K84205182: Guide contents | BIG-IP update and upgrade guide for how to update different BIG-IP products.

Technical Details

According to F5 incident briefing and telemetry from partners assisting with this incident, threat actors exfiltrated portions of BIG-IP source code, internal vulnerability reports, and developer/debugging artifacts from F5’s internal engineering and issue-tracking system. The exfiltrated data included design documents, code snippets tied to control-plane and data-plane modules, and internal test cases and crash dumps that reveal execution paths and error handling.

While currently F5 has no evidence of build-pipeline tampering, these artifacts are highly actionable. Beazley Security expects attackers to study these development artifacts to search for zero-day vulnerabilities and develop weaponized exploits when possible.

Beazley Security is also aware that the threat actors involved in this attack campaign against F5 networks leveraged the BRICKSTORM implant detailed by Mandiant in September 2025. Beazley Security strongly recommends that organizations whose threat model includes potentially being targeted by Nation State threat actors for espionage leverage the tooling and detection guidance provided by Mandiant to look for presence of BRICKSTORM in their environments.

Given that the threat actors involved in this espionage campaign were able to access source code, Beazley Security assesses it is likely that these actors will use the source code to identify and weaponize currently unknown zero-day vulnerabilities in these appliances. Organizations with F5 appliances deployed should work to segment these devices, monitor for suspicious traffic to or from the systems, ensure management interfaces are not exposed to the internet, and monitor F5 vendor channels for security updates. Organizations should plan to apply future patches as soon as they are released for F5 relevant appliances.

Disclosed Vulnerability Analysis

In addition to the incident notification, F5 patched a significant number of vulnerabilities that may have been disclosed to the attackers. These vulnerabilities impact various product lines and are detailed in their Quarterly Security Notification for October (K000156572).

Beazley Security has reviewed the vulnerabilities to quantify risk and impact and has provided analysis into these vulnerabilities below:

High Impact BIG-IP Vulnerabilities

Note: Beazley Security labs believes that sophisticated attackers could chain multiple of these vulnerabilities together to escalate privileges, gain access to the appliance's underlying operating system, and deploy custom Linux implants. Please note that there is very limited public information about these vulnerabilities, and as such, Beazley Security labs analysis is reliant on how attacks such as these have unfolded in the past.

As an example, an attacker with limited privileges, such as a resource administrator, could combine CVE-2025-59481 or CVE-2025-61958 with CVE-2025-53868 to run bash commands with higher privileges, escalate to an SCP-enabled role, and use CVE-2025-53868 to install malicious software on the F5 BIG IP appliance OS.

Additionally, Beazley Security Labs believes that the reflected XSS vulnerability (CVE-2025-61933) may be exploited by unauthenticated attackers to compromise authenticated users’ session cookies. Attackers could then potentially leverage this vulnerability in conjunction with other exploits listed below to deploy malicious implants or establish a reverse shell.

High Impact F5OS-A/C Vulnerabilities

Unauthenticated Denial of Service (DoS) Vulnerabilities (not grouped by product)

Note: many of the Denial of Service (DoS) vulnerabilities listed in this section result from memory corruption or related issues that can be triggered remotely by sending maliciously formatted traffic. It’s possible that in certain circumstances, such vulnerabilities could allow a highly skilled and well-resourced attacker to achieve objectives beyond simple service disruption. The potential for such capability development depends on factors such as the specific vulnerability context, whether the attacker can effectively manipulate memory in such a way to enable further access, and whether memory safety features are enabled.

Beazley Security Labs will continue to monitor these and provide updates if any of these vulnerabilities are abused beyond causing a Denial of Service condition.

Authenticated Denial of Service (DoS) Vulnerabilities (not grouped by product)

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• 

  F5 : K000154696 F5 Security Incident

• 

  F5 : K000156572 Quarterly Security Notification (October 2025)

• 

  K84205182: Guide contents | BIG-IP update and upgrade guide

• 

  CISA : ED 26-01: Mitigate Vulnerabilities in F5 Devices

• 

  Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors