F5 BIG-IP Vulnerabilities: Strategic Breach Response with Qualys | Qualys
Summary: In mid-October 2025, F5 disclosed a long-term breach by a nation-state actor that exfiltrated portions of BIG-IP source code and internal details of unpatched vulnerabilities, prompting CISA to label the event an imminent threat and add it to the KEV list. Qualys Threat Research Unit data on six weaponized F5 CVEs shows median time to patch rising from 21 days for CVE-2020-5902 to 175 days for CVE-2023-46748, with 7.8% to 15.5% of vulnerable instances still unpatched at the 365-day mark.
What you should know: The adversary's time-to-weaponize has dropped from months to hours or days using the stolen source code, while the median organization now takes 175 days to patch these appliances - and F5's new 44-CVE bundle (K000156572) closes the exact windows that stolen data exposed.
Read the original at Qualys Blog ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2020-5902
- Related
- Attackers target Ukraine using GoMet backdoor Cyber Risks ·Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report Cyber Risks ·CVE-2020-5902: F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021