F5 Networks Breach Triggers 3x Surge in Vulnerability Scanning
The CrowdSec Network has detected a dramatic surge in scanning activity targeting all F5 BIG-IP vulnerabilities following F5 Networks’ disclosure of a nation-state security breach on October 15th, 2025. Attack volumes across the entire F5 CVE landscape peaked on October 16th at three times normal levels, highlighting how public security incidents immediately attract opportunistic threat actors seeking to exploit enterprise infrastructure.
Key findings
Comprehensive F5 targeting: All F5 CVE scanning activity increased 300% within 24 hours of F5’s breach disclosure on October 15th, peaking on October 16th across the entire vulnerability portfolio.
Critical infrastructure targeting: CVE-2022-1388 (authentication bypass) shows 577 active exploiting IPs with "surging attack volumes" - making your load balancer an open door for attackers.
Legacy threat persistence: CVE-2020-5902 (RCE) maintains 11,622 exploiting IPs despite being a 5-year-old vulnerability, proving enterprise infrastructure remains attractive regardless of patch status.
