Post-EoL Security Exposure
Devices past their security-support date that are named in CISA's Known Exploited Vulnerabilities catalog.
This is not a CVE search tool. Every entry below is a specific device in our catalog that (1) is past the vendor's end-of-vulnerability-security-support or last-date-of-support date and (2) runs a platform listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The vendor is not patching these devices. The vulnerabilities are being exploited in the wild.
Correlation is at the platform level (Junos OS, PAN-OS, BIG-IP, SonicOS, Firebox, etc.). A specific CVE may affect only certain OS versions; the device may or may not have received the patch before the vendor cut off support. Assume exposure unless you've confirmed otherwise.
By vendor
Counts reflect post-EoL models running on an affected platform. A specific firmware version may not be vulnerable — verify with the vendor's PSIRT advisory.
| Vendor | Models on platform | Distinct CVEs | Ransomware-linked |
|---|---|---|---|
| Juniper | 859 | 7 | 0 |
| SonicWall | 54 | 3 | 2 |
| F5 Networks | 33 | 5 | 3 |
| Sophos | 23 | 3 | 0 |
| Palo Alto | 16 | 10 | 5 |
Flagged models
33 flagged devices (f5).
| Newest CVE added | Device | Vendor | CVEs | Ransom |
|---|---|---|---|---|
| 1000 (D39) BIG-IP | F5 Networks | 5 | Yes | |
| 11000 (E101) | F5 Networks | 5 | Yes | |
| 11050 (E102) | F5 Networks | 5 | Yes | |
| 1500 (C36) | F5 Networks | 5 | Yes | |
| 1600 (C102) | F5 Networks | 5 | Yes | |
| 2000s (C112) | F5 Networks | 5 | Yes | |
| 2200s (C112) | F5 Networks | 5 | Yes | |
| 3400 (C62) | F5 Networks | 5 | Yes | |
| 3410 (C100) | F5 Networks | 5 | Yes | |
| 3600 (C103) | F5 Networks | 5 | Yes | |
| 3900 (C106) | F5 Networks | 5 | Yes | |
| 4000s (C113) | F5 Networks | 5 | Yes | |
| 4200v (C113) | F5 Networks | 5 | Yes | |
| 5000s LTM standalone (C109) | F5 Networks | 5 | Yes | |
| 5050s (C109) | F5 Networks | 5 | Yes | |
| 5100 (D51c) | F5 Networks | 5 | Yes | |
| 520 BIG-IP e-Commerce Controller | F5 Networks | 5 | Yes | |
| 5200v LTM standalone / SSL (C109) | F5 Networks | 5 | Yes | |
| 5250v (C109) | F5 Networks | 5 | Yes | |
| 540 BIG-IP e-Commerce Controller | F5 Networks | 5 | Yes | |
| 6400 (D63) | F5 Networks | 5 | Yes | |
| 6800 (D68) | F5 Networks | 5 | Yes | |
| 6900 (D104) | F5 Networks | 5 | Yes | |
| 6900s SSL (D104) | F5 Networks | 5 | Yes | |
| 7000s LTM standalone (D110) | F5 Networks | 5 | Yes | |
| 7050s (D110) | F5 Networks | 5 | Yes | |
| 7250v (D110) | F5 Networks | 5 | Yes | |
| 8400 (D84) | F5 Networks | 5 | Yes | |
| 8800 (D88) | F5 Networks | 5 | Yes | |
| 8900 (D106) | F5 Networks | 5 | Yes | |
| 8950 (D107) | F5 Networks | 5 | Yes | |
| 8950s (D107) | F5 Networks | 5 | Yes | |
| VIPRION 4400 Chassis (J100) | F5 Networks | 5 | Yes |
Operators running any device in this list should treat it as a compensating-control scenario under NIST SA-22 and the equivalent PCI-DSS, HIPAA, and cyber-insurance guidance. See the Compliance and Insurance page for clause-level context and control options.
Source: CISA Known Exploited Vulnerabilities catalog. Snapshot refreshed weekly.