F5 Products Multiple Vulnerabilities
CSIRTS triage
- What
- Multiple vulnerabilities exist in F5 products.
- Who is affected
- Deployments of various F5 products are affected.
- Urgency
- Remediation urgency is unclear due to unknown severity and no exploitation reported.
- Action
- Check for updates from F5 regarding these vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
Details
Original advisory: https://www.hkcert.org/security-bulletin/f5-products-multiple-vulnerabilities_20260729
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation likely imminentCVE-2025-48976EPSS puts this in the most-targeted tier (62.6% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 99.1% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-664180.68% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-64740.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-66370.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2025-48976 | coverage & exploitation status | NVD · CVE.org |
| CVE-2025-66418 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-6474 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-6637 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[UPDATE] [hoch] PostgreSQL: Mehrere Schwachstellencert-bund
- high[UPDATE] [hoch] Red Hat Enterprise Linux (urllib3): Mehrere Schwachstellen ermöglichen Denial of Servicecert-bund
- medium[UPDATE] [medium] Red Hat OpenShift and OpenShift AI (urllib3): Vulnerability allows denial of servicecert-bund
- criticalexploited[UPDATE] [critical] Oracle Fusion Middleware: Multiple Vulnerabilitiescert-bund
- unknownNCSC-2026-0321 [1.00] [M/H] Meerdere kwetsbaarheden verholpen in IBM AIX en IBM PowerVM VIOSncsc-nl
- unknownexploitedMultiple vulnerabilities in IBM products (August 21, 2026)cert-fr-avis
- unknownMultiple vulnerabilities in Splunk products (20 August 2026)cert-fr-avis
- unknownPostgreSQL Multiple Vulnerabilitieshkcert
- high[UPDATE] [high] Dell PowerProtect Data Domain OS: Multiple vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in Tenable products (August 4, 2026)cert-fr-avis
- high[NEW] [high] Oracle Communications: Multiple vulnerabilitiescert-bund
- high[UPDATE] [high] IBM QRadar SIEM: Multiple vulnerabilitiescert-bund
More from HKCERT Security Bulletins
- unknownCisco Products Multiple Vulnerabilities2026-09-15
- unknownApple Products Multiple Vulnerabilities2026-09-15
- unknownPhishing Alert - Beware of Phishing Activities Leading to Unauthorised Credit Card Transactions2026-09-14
- unknownGitLab Multiple Vulnerabilities2026-09-14
- unknownMongoDB Multiple Vulnerabilities2026-09-10