U.S. CISA adds a flaw in F5 BIG-IP AMP to its Known Exploited Vulnerabilities catalog
2026-03-28T08:51:52Z•651b5fafe59c07c194c7bab6831c6e3a40a8ca12c68ba5e306e9364feacd35ba
AITM phishingAquasecurity TrivyBIG-IP APMBPFDoorCISA KEVEuropean Commission cloud incidentF5 BIG-IPFlexPLMLangflowLeakBase arrestPTC WindchillRed Menshen APTTikTok BusinessWebRTC skimmeractive exploitationcritical vulnerabilityiOS exploit (Coruna/Triangulation)malvertisingpayment‑card skimmertelecom espionageunpatched/zero-day
What happened
Multiple high‑risk vulnerabilities and diverse attack activity were reported across public- and private-sector targets. The U.S. CISA added several flaws to its Known Exploited Vulnerabilities (KEV) catalog, including an F5 BIG-IP APM issue (CVE-2025-53521, CVSS 9.8), an Aqua Security Trivy vulnerability (CVE-2026-33634, CVSS 9.3) and a Langflow flaw (CVE-2026-33017, CVSS 9.3). CISA and Germany’s BSI warned of a critical, currently unpatched PTC Windchill/FlexPLM vulnerability (CVE-2026-4681, CVSS 10.0) with potential imminent exploitation. Other notable incidents: the European Commission had/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 651b5fafe59c07c194c7bab6831c6e3a40a8ca12c68ba5e306e9364feacd35ba
- Enrichment time
- 2026-03-28T08:51:52Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.