Cybersecurity Database

Directive

ED 26-01 – F5 device vulnerabilities

ED 26-01: Mitigate Vulnerabilities in F5 Devices

In force since 15 October 2025Record checked against the official source on 2 November 2026 · Methodology

Official source: https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices

Official source
Official number
ED 26-01
Date adopted
Entry into force

Summary

Emergency directive issued by CISA on 15 October 2025 after a nation-state affiliated actor compromised F5's systems and exfiltrated part of the BIG-IP source code and vulnerability information, which could help it find zero-day vulnerabilities and develop targeted exploits. It covers BIG-IP iSeries and rSeries devices, end-of-support F5 devices and the F5OS, TMOS, Virtual Edition, BIG-IP Next, BIG-IQ and BNK/CNF software. Federal agencies must inventory them immediately, check whether management interfaces are reachable from the internet and, if so, apply BOD 23-02, update the main software by 22 October and other devices by 31 October, apply later updates within one week of release and disconnect exposed end-of-support devices. Reports to CISA were due on 29 October and 3 December 2025.

Who it applies to

Federal agencies, for assets in any federal information system, including those operated by third parties on their behalf. National security systems and Department of War and intelligence community systems are excluded.

Key dates

  1. F5OS, TMOS, BIG-IQ and BNK/CNF updated to the vendor's latest release
  2. Summary of in-scope F5 products submitted to CISA (11:59 PM ET)
  3. Latest software patch and F5 hardening guidance applied to the other F5 devices
  4. Detailed inventory of all in-scope F5 product instances submitted to CISA
  5. CISA report on cross-agency implementation status

Information

Jurisdiction
United States
Issuing body
Cybersecurity and Infrastructure Security Agency (CISA)
Type
Directive
Available languages
English
Topics
Notes
The directive lists no vulnerabilities by CVE number. Agencies whose management interfaces are reachable only through a jump box on a management network may note this in their report and follow their regular update schedule. The page gives no end date for the directive and no later versions.

Record details

Original title
ED 26-01: Mitigate Vulnerabilities in F5 Devices
Title in other languages
  • ED 26-01: mitigare le vulnerabilità dei dispositivi F5
  • ED 26-01 : atténuer les vulnérabilités des équipements F5
  • ED 26-01: mitigar las vulnerabilidades de los dispositivos F5
  • ED 26-01: Behebung von Schwachstellen in F5-Geräten
Licence / terms of use
Public domain / official act – Work of the United States federal government (17 U.S.C. § 105).
Collected from
manual entry
Last verified
(verified via web)

How to cite

APA

Cybersecurity and Infrastructure Security Agency (CISA). (2025). ED 26-01: Mitigate Vulnerabilities in F5 Devices (ED 26-01). https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices

Chicago

Cybersecurity and Infrastructure Security Agency (CISA). "ED 26-01: Mitigate Vulnerabilities in F5 Devices." 15 October 2025. https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices.

BibTeX

@misc{us_ed_26_01_f5_2025,
  author       = {{Cybersecurity and Infrastructure Security Agency (CISA)}},
  title        = {{ED 26-01: Mitigate Vulnerabilities in F5 Devices}},
  year         = {2025},
  note         = {ED 26-01},
  url          = {https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices},
  urldate      = {2026-11-02}
}

Metadata and summary: CC BY 4.0 · JSON