F5's 2025 Breach From the Primary Sources: Long-Term Nation-State Access to BIG-IP's Development Environment, What the SEC Filing and CISA Say Was Taken, and What to Check on Your Devices
If you run F5 BIG-IP, keep it on the latest vendor update and make sure its management interface cannot be reached from the internet. Those are the two things CISA ordered federal agencies to do after F5 disclosed on October 15, 2025 that a nation-state actor had long-term access to its BIG-IP development environment and took files that included part of the BIG-IP source code and information about undisclosed vulnerabilities. This page sets out what F5's own SEC filing and CISA's directive say, because some secondary coverage mixes those facts with claims neither document makes.
What F5 says happened
According to its Form 8-K filed October 15, 2025, F5 learned on August 9, 2025 that a highly sophisticated nation-state threat actor had gained unauthorized access to some of its systems. The actor held long-term, persistent access to the BIG-IP product development environment and the engineering knowledge management platform. Files were taken, some containing portions of BIG-IP source code and information about undisclosed vulnerabilities. Some files from the knowledge management platform held configuration or implementation information for a small percentage of customers.
The filing says the Department of Justice determined on September 12, 2025 that delaying public disclosure was warranted under the SEC's rule for that purpose. It does not say why. From August 9 to the October 15 disclosure is 67 days.
What F5 says it did not find
F5 says it has no evidence of modification to its software supply chain, including source code and the build and release pipelines. It says it has no evidence of access to or theft of data from its CRM, financial, support case management or iHealth systems, and no evidence that the NGINX source code or its development environment was accessed or changed. It says it has no evidence about F5 Distributed Cloud Services or Silverline systems being accessed or modified. It states it is not aware of undisclosed critical or remote code execution vulnerabilities, or of active exploitation of undisclosed vulnerabilities.
F5 says it believes its containment has worked and has seen no new unauthorized activity since it began, that the investigation and monitoring continue, and that it is working with federal law enforcement. It says the incident had not had a material impact on its operations as of the filing.
What CISA ordered
CISA issued Emergency Directive 26-01 the same day. It says the actor stole files including a portion of BIG-IP source code and vulnerability information, and that this access could give the actor a technical advantage in finding and exploiting F5 devices and software. It calls the actor an imminent threat to federal networks, and warns that successful exploitation could give access to embedded credentials and API keys, lateral movement, data exfiltration and persistent access, and could potentially lead to a full compromise of target information systems.
For federal agencies it required:
Immediately, an inventory of all BIG-IP hardware and all in-scope software instances.
A check of whether networked management interfaces are reachable from the public internet, with exposed ones handled under the existing binding directive and reported to CISA.
By October 22, 2025, the latest vendor update for F5OS, BIG-IP TMOS, BIG-IQ and BIG-IP Next for Kubernetes and Cloud-Native Network Functions.
By October 31, 2025, the latest patch for all other F5 devices, and F5's hardening guidance.
Updates within one week of each later vendor release.
Disconnection of public-facing devices that have reached end of support.
Reports of in-scope products by October 29 and a detailed inventory by December 3, 2025.
The in-scope products are the BIG-IP iSeries and rSeries hardware, any F5 device past end of support, and the software lines BIG-IP (F5OS), BIG-IP (TMOS), Virtual Edition, BIG-IP Next, BIG-IQ and BIG-IP Next for Kubernetes and Cloud-Native Network Functions.
What neither document says
Neither names the actor. CISA does not say which nation-state is responsible, and F5's filing does not either. Neither says the stolen vulnerability information has been used against anyone. Claims you may see elsewhere, such as a named threat group or specific malware, come from third-party write-ups and are not in the filing or the directive. We did not verify them.
What came after, in our own index
We have written about this before, in a March 2026 roundup that mentions the stolen source code. In CISA's catalog of exploited vulnerabilities, our index holds CVE-2025-53521, a stack-based buffer overflow in F5 BIG-IP Access Policy Manager that could allow remote code execution, with a date of March 27, 2026, which is when it was added. We are not saying that flaw is connected to the theft. The sources above do not say so, and we have no evidence of it.
What to check on your devices
The directive binds federal agencies, but its steps are reasonable for anyone running BIG-IP. These are our suggestions, built from CISA's.
List every F5 device and software instance, including virtual and cloud ones nobody remembers.
Confirm the management interface is not reachable from the internet. If you cannot confirm it, assume it is.
Move to the latest vendor update and keep a habit of applying new ones quickly. If the actor holds source code and vulnerability notes, the time between a fix and an exploit may be shorter.
Replace devices that are out of support rather than leaving them exposed.
Rotate credentials and API keys that live on or are reachable from the devices. CISA's own warning names embedded credentials and API keys.
Ask your F5 account team whether any configuration or implementation files about your environment were among those taken, since F5 says some customers' were.
Indicators
None. Neither document published network or file indicators that we could verify, so we added nothing to the feed.
Limits
We read F5's Form 8-K and CISA's Emergency Directive 26-01. We could not load F5's own customer notice, which needs a browser, and we did not read third-party analyses beyond noting what they claim. F5's statements are its own, and "no evidence" means none found so far. The in-index CVE is context, not a finding of a link.
Five percent of this is wrong somewhere. It always is. F5's later notices or a CISA update would change what is current.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments