F5 Networks, a leading provider of application security and delivery solutions, has disclosed a significant security breach involving a nation-state threat actor, prompting the release of critical updates for its core products.

Detected in August 2025, the incident exposed internal systems to prolonged unauthorized access, leading to the theft of BIG-IP source code and undisclosed vulnerability data.

In response, F5 has rolled out patches across BIG-IP, F5OS, BIG-IQ, APM clients, and BIG-IP Next for Kubernetes to safeguard customers amid heightened risks.

The intrusion came to light on August 9, 2025, when F5 identified suspicious activity within its BIG-IP product development environment and engineering knowledge platforms.

The advanced adversary maintained persistent access, exfiltrating sensitive files including portions of source code and configuration details for a limited number of customers.

No evidence suggests alterations to the software supply chain or impacts on production systems, but the stolen intellectual property raises concerns about potential zero-day exploits targeting unpatched deployments.

F5 swiftly contained the threat through comprehensive measures, halting further unauthorized actions and confirming no ongoing intrusions.

The company enlisted top cybersecurity firms like CrowdStrike and Mandiant for investigation support, while collaborating with law enforcement and government agencies.

This proactive stance aligns with F5’s vulnerability management practices, now intensified to bolster enterprise and product security postures.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) responded with Emergency Directive ED 26-01, mandating federal agencies to patch and isolate affected F5 assets immediately.

F5 Security Updates

On October 15, 2025, F5 published its Quarterly Security Notification, detailing 44 vulnerabilities addressed in the latest releases, many tied to the breach’s implications.

High-severity CVEs dominate, with scores up to 8.7 under CVSS v3.1, affecting components like SCP/SFTP in BIG-IP (CVE-2025-53868) and F5OS platforms (CVE-2025-61955).

These flaws enable potential denial-of-service, privilege escalation, and remote code execution, particularly in appliance modes where risks escalate.

Medium and low-risk issues include iControl REST vulnerabilities (CVE-2025-59481) and configuration utility exposures, fixed in versions such as BIG-IP 17.5.1.3 and F5OS-C 1.8.2.

High Severity Vulnerabilities

Medium Severity Vulnerabilities

Low Severity Vulnerabilities

Security Exposures

BIG-IP Next for Kubernetes receives targeted hotfixes, like 2.1.0 EHF-14, to mitigate TMM and SSL/TLS weaknesses. Security exposures in BIG-IP AFM are also resolved, emphasizing the need for swift upgrades across all supported versions.

F5 stresses that while no active exploitation of undisclosed flaws is known, updating is essential to prevent lateral movement and data exfiltration in customer networks.

Customers should prioritize applying these updates, enabling event streaming to SIEM tools, and isolating management interfaces from public access.

Decommissioning end-of-life products further reduces exposure. F5’s transparency underscores the evolving nation-state threats, where stolen code could fuel sophisticated attacks on critical infrastructure.

By patching promptly, organizations can maintain robust defenses against this and future incidents. For full details, refer to F5’s official notification.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post F5 Released Security Updates Covering Multiple Products Following Recent Hack appeared first on Cyber Security News.

Cisco has disclosed a severe vulnerability in its widely used IOS and IOS XE Software, potentially allowing attackers to crash devices or seize full control through remote code execution.

The flaw, rooted in the Simple Network Management Protocol (SNMP) subsystem, stems from a stack overflow condition that attackers can trigger with a specially crafted SNMP packet over IPv4 or IPv6 networks.

This issue affects all SNMP versions and has already seen exploitation in the wild, highlighting the urgency for network administrators to act swiftly.

The vulnerability enables two main attack vectors. A low-privileged, authenticated remote attacker armed with SNMPv2c read-only community strings or valid SNMPv3 credentials could induce a denial-of-service (DoS) condition, forcing affected devices to reload and disrupting network operations.

More alarmingly, a highly privileged attacker with administrative or privilege level 15 access could execute arbitrary code as the root user on IOS XE devices, granting complete system takeover.

Cisco’s Product Security Incident Response Team (PSIRT) discovered this during a Technical Assistance Center support case, and real-world exploits followed compromised local administrator credentials.

This flaw impacts a broad range of Cisco devices running vulnerable IOS or IOS XE releases with SNMP enabled, including routers, switches, and access points essential to enterprise infrastructures.

Devices that haven’t explicitly excluded the affected object ID (OID) remain at risk. Notably, IOS XR Software and NX-OS Software are unaffected, providing some relief for users of those platforms.

The potential fallout is significant: DoS attacks could halt critical services, while root-level code execution might enable data theft, lateral movement in networks, or deployment of malware.

Given SNMP’s ubiquity for device monitoring, many organizations unwittingly expose themselves by leaving default configurations intact.

Mitigations

Cisco emphasizes that no full workarounds exist, but mitigations can curb immediate threats. Administrators should restrict SNMP access to trusted users only and monitor via the “show snmp host” CLI command.

A key step involves disabling vulnerable OIDs using the “snmp-server view” command to create a restricted view, then applying it to community strings or SNMPv3 groups. For Meraki cloud-managed switches, contacting support is advised to implement these changes.

Patches are now available through Cisco’s September 2025 Semiannual Security Advisory Bundled Publication. Users can verify exposure and find fixed releases using the Cisco Software Checker tool.

To check SNMP status, run CLI commands like “show running-config | include snmp-server community” for v1/v2c or “show snmp user” for v3.

Cisco urges immediate upgrades to fortified software, warning that delays could invite further exploits. As networks grow more interconnected, such vulnerabilities underscore the need for rigorous SNMP hardening and proactive patching.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Cisco IOS and IOS XE Software Vulnerabilities Let Attackers Execute Remote Code appeared first on Cyber Security News.