BIG-IP (LTM, APM, ASM, AFM) 17.5 vulnerabilities

2 advisories affect F5 BIG-IP (LTM, APM, ASM, AFM) 17.5, 2 already exploited by attackers. Latest: September 22, 2026.

Running BIG-IP (LTM, APM, ASM, AFM) 17.5 devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on BIG-IP (LTM, APM, ASM, AFM) 17.5 alerts

Vulnerability	Severity	Affected versions
F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability CVE-2026-94127 · September 22, 2026	Critical 9.8 Exploited	from 17.5.0 to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG (excluded)
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability CVE-2025-53521 · March 27, 2026	Critical 9.8 Exploited	from 17.5.0 to 17.5.1.3 (excluded) Fixed in 17.5.1.3

Affected versions are compiled automatically from vendor advisories and NVD and may contain errors. Where no fixed version is shown, you will find it in the official advisory linked from every page: check it there before updating.

Other BIG-IP (LTM, APM, ASM, AFM) versions: 17.1