On 15 October 2025 CISA issued Emergency Directive 26-01 after a nation-state affiliated actor compromised F5 and took files including part of the BIG-IP source code and vulnerability information. The directive told federal agencies to inventory devices, remove public management exposure and patch. Any F5 user can follow the same steps.
What CISA said happened
CISA states that the stolen material could help an attacker find logic flaws and zero-day vulnerabilities and build targeted exploits. It called this an imminent threat to federal networks using F5 products. It warned that successful exploitation could expose embedded credentials and API keys, allow lateral movement and data theft, and give persistent access.
Affected products named in the directive include BIG-IP iSeries and rSeries hardware, any F5 device past end of support, and software such as BIG-IP (F5OS and TMOS), Virtual Edition, BIG-IP Next, BIG-IQ and BIG-IP Next for Kubernetes.
What agencies were told to do
The directive set a sequence:
- Inventory every in-scope BIG-IP device and software instance immediately.
- Check whether management interfaces are reachable from the public internet, and report confirmed exposures.
- Apply the latest vendor updates to the F5OS, TMOS, BIG-IQ and Kubernetes components by 22 October 2025, with a later date of 31 October for other in-scope devices.
- Disconnect and decommission public-facing devices that have reached end of support, or report a mission-critical need and a decommissioning plan.
- Apply later F5 updates within one week of release.
Agencies also owed a summary of products by 29 October 2025 and a detailed inventory by 3 December 2025.
A checklist for everyone else
You do not need to be a federal agency to use this list.
- Find every F5 device and version, including virtual editions and anything in a lab or a forgotten data center.
- Confirm that no management interface faces the internet. If one must, restrict it to a jump host or a management network.
- Patch on a short clock. When source code is stolen, defenders should assume attackers will study it for flaws before patches reach everyone.
- Retire end of support units. They stop getting fixes at the time you need them most.
- Rotate credentials, API keys and certificates stored on or reachable from the devices, since CISA names embedded credentials as a risk.
- Watch for unusual access to the device configuration and for new accounts.
What this says about security vendors as targets
Edge and network appliances sit in front of everything. When their maker is breached, the risk moves to every customer at once. The same applies to any vendor whose product holds secrets or sits in the traffic path. Treat your vendors as part of your attack surface and ask how they would tell you about a breach.
Where Safeguard fits
Safeguard's asset discovery and SBOM scanning can help you build the inventory that step one needs for software you run and package. It does not replace the vendor's own patches for appliances. A free scan is at gold.safeguard.sh/scan.
Quick check
What did CISA say was stolen from F5?
A portion of the BIG-IP source code and vulnerability information, according to Emergency Directive 26-01.
What should you do first if you run BIG-IP?
Inventory every device, check that management interfaces are not internet reachable, and apply the latest updates.
Sources
Last reviewed: 19 October 2026.
