F5 vulnerability highlights weak points in DHS\u2019s CDM program | CyberScoop<\/title> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"F5 vulnerability highlights weak points in DHS\u2019s CDM program\"> <meta property=\"og:description\" content=\"The Continuous Diagnostics and Mitigation program is oft-praised, but there are areas where it doesn\u2019t yet excel, as a recent CISA emergency directive shows.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2025-10-23T10:00:00+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/10\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1240\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Tim Starks\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@timstarks\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1759256725g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1761070183g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1753281318g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=13897d660a0ac2c9c7d1\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/86465\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.8.3\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=86465\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Ff5-vulnerability-highlights-weak-points-in-dhss-cdm-program%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Ff5-vulnerability-highlights-weak-points-in-dhss-cdm-program%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-86465 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"26.25283446712\">\n<div class=\"single-article__header-content\" readability=\"36.181818181818\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program\/\"> <span>Government<\/span> <\/a> <\/li>\n<\/ul>\n<p> The Continuous Diagnostics and Mitigation program is oft-praised, but there are areas where it doesn\u2019t yet excel, as a recent CISA emergency directive shows. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/86465\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"413\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/10\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program.jpg?resize=640%2C413&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/10\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/10\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program-2.jpg?resize=300,194 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/10\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program-2.jpg?resize=768,496 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/10\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program-2.jpg?resize=1024,661 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/10\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program-2.jpg?resize=1536,992 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/10\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program-2.jpg?resize=600,388 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/10\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program-2.jpg?resize=260,168 260w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/10\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program-2.jpg?resize=522,337 522w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/10\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program-2.jpg?resize=1045,675 1045w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/10\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program-2.jpg?resize=1305,843 1305w\" sizes=\"(max-width: 1045px) 100vw, 1045px\"><figcaption> twomeows, Getty Images <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"112.90800615858\"><body readability=\"234.33055812519\"><\/p>\n<p>Last week, Cybersecurity and Infrastructure Security Agency officials spoke candidly about the challenges they faced tracking the use of F5 products across the civilian federal government. While CISA knows there are thousands of instances of F5 currently in use, it admitted it wasn\u2019t certain where each instance was deployed. <\/p>\n<p>The uncertainty came as the agency issued an emergency directive related to F5, instructing other government agencies to find and patch any F5 instances. The urgency stemmed from the fact that F5 itself had revealed a nation-state had gained a long-term foothold in its systems.<\/p>\n<p>One of the main goals of the directive: \u201chelp us identify the different F5 technology in the federal network,\u201d as one official <a href=\"https:\/\/cyberscoop.com\/cisa-emergency-directive-f5-breach\/\">told reporters<\/a>.<\/p>\n<p>CISA didn\u2019t already have a complete picture of that despite the billions of dollars spent on a program, Continuous Diagnostics and Mitigation (CDM), designed for, among other things, \u201cincreasing visibility into the federal cybersecurity posture,\u201d which <a href=\"https:\/\/www.cisa.gov\/resources-tools\/programs\/continuous-diagnostics-and-mitigation-cdm-program\">CISA\u2019s website<\/a> for the program states is one of its main four goals.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>CISA\u2019s lack of awareness about the extent of the F5 vulnerability\u2019s presence in the federal government highlights a weakness in a program that is, by and large, a well-regarded one. But the fact that CDM did not automatically identify F5 prevalence is a circumstance of fast-changing technology and a shortcoming in the part of CDM that\u2019s focused on keeping track of digital assets, according to current and former CISA officials and cyber industry professionals.<\/p>\n<h3 class=\"wp-block-heading\" id=\"h-missing-the-edge\">Missing the edge<strong> <\/strong><\/h3>\n<p>\u201cCDM has been highly focused on typical assets, like computers and servers, and they\u2019ve struggled on the network side in many cases,\u201d Jonathan Trull, CISO at Qualys, told CyberScoop. <\/p>\n<p>Sean Connelly, an 11-year CISA veteran, said he\u2019s been familiar with CDM dating back to its earliest days. The program began in 2012 with $6 billion in contracts. The Department of Homeland Security had received billions to administer the program over its first decade and as of 2022, planned to <a href=\"https:\/\/federalnewsnetwork.com\/reporters-notebook-jason-miller\/2022\/11\/cisa-signature-federal-cyber-program-warrants-more-than-a-passing-anniversary-nod\/\">spend billions more<\/a> on it over the next 10 years.<\/p>\n<p>\u201cA lot of the CDM capabilities initially were more focused on internal networks and what was internally going on inside the agencies themselves, and more about mission-oriented systems, not systems that were directly connected to the internet,\u201d Connelly, now executive director for global zero trust strategy and policy at ZScaler, told CyberScoop. That contrasts with F5\u2019s presence on edge devices, he said.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cThose type of devices, just those firewalls and those type of devices at the edge, typically, they don\u2019t have the same type of reporting capabilities as the internal networks, or ones where you can put some type of agent on the device,\u201d Connelly continued. \u201cA lot of those edge devices, they\u2019re proprietary. They don\u2019t have the ability to be able to put a sensor on.\u201d<\/p>\n<p>Edge devices also happen to be a favorite target of hackers right now, especially China-linked ones, said Matt Hartman, the former deputy executive assistant director for cybersecurity at CISA.<\/p>\n<p>\u201cGiven the scale and diversity of agency networks, there are visibility gaps, especially for technologies like network edge devices,\u201d Hartman, now chief strategy officer at Merlin Group, told CyberScop in written answers. \u201cDevices like F5 BIG-IP load balancers often reside in demilitarized zones, or DMZs, that sit between an agency\u2019s internal network and the public internet. These environments aren\u2019t always monitored by the same inventory and telemetry tools as agencies\u2019 enterprise networks. And because of where these devices sit and the nuances of how they are monitored, they are an ideal entry point or pivot point for adversaries.\u201d<\/p>\n<p>Connelly said the CDM team is constantly focused on expanding its visibility into federal networks. And he said there are other programs that can help with that outside of CDM, like <a href=\"https:\/\/cyberscoop.com\/cisa-cyber-hygiene-critical-infrastructure-report\/\">CISA\u2019s cyberhygiene service<\/a>, CyHy.<\/p>\n<p>The F5 vulnerability isn\u2019t the only one to illustrate where CDM needs work to increase visibility. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Matt House, CDM program manager, <a href=\"https:\/\/federalnewsnetwork.com\/ask-the-cio\/2024\/08\/cisas-cdm-to-take-on-next-cyber-blind-spot-in-the-cloud\/\">said last year<\/a> that CDM was looking to tackle cloud infrastructure. But he said \u201cwe are largely blind\u201d when applying existing CDM tools for platform-as-a-service and software-as-a-service, and that a first step to changing that was looking at how CDM defines assets. He also said not every agency has 100% identification and monitoring of assets for even on-premise hardware.<\/p>\n<p>Trull said that \u201cthe consideration of what an asset is has changed tremendously.\u201d<\/p>\n<p>A June <a href=\"https:\/\/www.gao.gov\/products\/gao-25-107470\">Government Accountability Office report<\/a> found that CDM had \u201cpartially met\u201d its cybersecurity visibility goals, with CISA and the Office of Management and Budget creating helpful \u201cdashboards\u201d for agencies. But a lack of CISA guidance is holding back those goals, the report concluded.<\/p>\n<p>\u201cThe dashboards are intended to visualize information from each of the capability areas, providing insight into the cybersecurity posture associated with assets, users, networks, and data,\u201d the report states. \u201cHowever, officials from 21 of the 23 civilian \u2026 agencies stated that they had not fully implemented capabilities within the network security management and data protection management areas. According to officials from several agencies, they are awaiting additional guidance from CISA regarding these capabilities.\u201d<\/p>\n<p>CISA also doesn\u2019t consider CDM adequate for identifying systems for migration to post-quantum cryptography, it <a href=\"https:\/\/www.nextgov.com\/cybersecurity\/2024\/09\/cisa-guidance-focuses-post-quantum-cryptography-tools\/399904\/?oref=ng-topic-lander-top-story\">concluded last year<\/a>.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Hartman \u2014 who, like everyone CyberScoop interviewed for this story, praised the CDM program \u2014 emphasized that any current shortcomings do not reflect the program\u2019s future capabilities. <\/p>\n<p>\u201cToday, CDM excels on traditional IT assets, like servers and workstations, but is not fully optimized for specialized systems like OT and IoT, or cloud-native resources and containerized workloads that change dynamically,\u201d he said. \u201cThe positive news is that CISA fully acknowledges these gaps and they are on the CDM deployment roadmap.\u201d<\/p>\n<h3 class=\"wp-block-heading\" id=\"h-how-cdm-works-with-the-directive\">How CDM works with the directive<\/h3>\n<p>In lieu of automated CDM identification, an emergency directive like the one issued for the F5 vulnerability triggers a series of federal agency responses.<\/p>\n<p>\u201cThe process typically begins with inventory validation: confirming what assets are in place, where they reside and how they are configured,\u201d Shane Barney, CISO at Keeper Security and former CISO at U.S. Citizenship and Immigration Services, said in a written reply. \u201cTo address issues related to devices like F5 systems, agency teams rely on multiple data sources, including network scans, asset inventories and procurement records, to ensure complete visibility and to account for every system.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Hartman said \u201cCDM has streamlined how CISA and agencies are able to quickly and comprehensively inventory their environments,\u201d improving the speed of the emergency directive process.<\/p>\n<p>A CISA spokesperson, Marci McCarthy, said the emergency directive \u201cwas a great example of CISA working with a technology partner to communicate important and timely information.\u201d<\/p>\n<p>CISA officials who briefed the media last week said federal agency budget and personnel cutbacks wouldn\u2019t have any impact on response to the directive. Ohio Rep. Shontel Brown, the top Democrat on the Oversight Subcommittee on Cybersecurity, Information Technology, and Government Innovation, said she was concerned about how those cuts might affect CDM\u2019s performance.<\/p>\n<p>\u201cAs Ranking Member, I support the Continuous Diagnostics and Monitoring program,\u201d Brown told CyberScoop in a written statement. \u201cHowever, the Trump Administration\u2019s mass firings and funding cuts have jeopardized the effectiveness of this program. I will continue to monitor the situation at CISA and demand transparency and oversight to support the agency\u2019s efforts in this nation\u2019s cybersecurity.\u201d<\/p>\n<p>The emergency directive process works in large part because of agency collaboration, said Jeff Greene, former executive assistant director for cybersecurity at CISA.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cCISA\u2019s dramatic improvements in protecting\u201d federal civilian agencies \u201cand the effectiveness of the ED process specifically was one of the biggest surprises when I got to the cybersecurity division,\u201d Greene, who since has joined the senior cyber leadership team of Cambridge Global Advisors, told CyberScoop. \u201cIt worked because we partnered with the other agencies, and the team was careful only to go use an ED when it was truly necessary.\u201d<\/p>\n<p>CDM\u2019s existence, however, is vital overall to responding to incidents like the F5 vulnerability, said Bill Wright, global head of government affairs at Elastic.<\/p>\n<p>\u201cWithout a mature, comprehensive CDM program, federal agencies could be flying blind,\u201d he said in a written statement. \u201cThis incident demonstrates that CDM is the foundational capability that makes a rapid, government-wide response like this possible.\u201d<\/p>\n<p>The F5 vulnerability exposure \u201chighlights a critical tension between CDM\u2019s intended outcomes and real-world execution,\u201d said Ensar Seker, CISO at SOCRadar.<\/p>\n<p>\u201cThe fact that agencies are now scrambling to inventory thousands of F5 instances, many potentially exposed, shows the gap that still exists between data collection and actionable insight,\u201d he told CyberScoop in a written comment. \u201cCDM may technically collect asset data, but if that data isn\u2019t normalized, federated, or readily queryable across agency environments, it loses operational utility in moments like this.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p><em>Matt Kapko contributed reporting to this story.<\/em><\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\">\n<div class=\"author-card\" readability=\"7.7216117216117\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/10\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program-1.jpg?w=640&ssl=1\" alt=\"Tim Starks\"> <\/figure>\n<\/p><\/div>\n<div class=\"author-card__details\" readability=\"10.901098901099\">\n<h4 class=\"author-card__name\">Written by Tim Starks<\/h4>\n<p> Tim Starks is senior reporter at CyberScoop. His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly. An Evansville, Ind. native, he’s covered cybersecurity since 2003. Email Tim here: <a href=\"mailto:tim.starks@cyberscoop.com\">tim.starks@cyberscoop.com<\/a>. <\/div>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>F5 vulnerability highlights weak points in DHS\u2019s CDM program |<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[5269,2983,78,452,5270,293,3935,3889,117,2012,1783,3259,5271,5272,1571,439,3907,3525,5273,3650,4345],"tags":[5274,2989,86,454,5275,299,3936,3892,119,2013,1790,3260,5276,5277,1572,443,3908,3527,5278,3653,4348],"class_list":["post-8102","post","type-post","status-publish","format-standard","hentry","category-cambridge-global-advisors","category-continuous-diagnostics-and-mitigation","category-cybersecurity","category-cybersecurity-and-infrastructure-security-agency-cisa","category-cyhy","category-department-of-homeland-security-dhs","category-elastic","category-f5","category-government","category-government-accountability-office","category-house-oversight-committee","category-jeff-greene","category-keeper-security","category-matt-hartman","category-office-of-management-and-budget","category-policy","category-post-quantum-cryptography","category-qualys","category-sean-connelly","category-shontel-brown","category-zscaler","tag-cambridge-global-advisors","tag-continuous-diagnostics-and-mitigation","tag-cybersecurity","tag-cybersecurity-and-infrastructure-security-agency-cisa","tag-cyhy","tag-department-of-homeland-security-dhs","tag-elastic","tag-f5","tag-government","tag-government-accountability-office","tag-house-oversight-committee","tag-jeff-greene","tag-keeper-security","tag-matt-hartman","tag-office-of-management-and-budget","tag-policy","tag-post-quantum-cryptography","tag-qualys","tag-sean-connelly","tag-shontel-brown","tag-zscaler"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cambridge-global-advisors\/\" rel=\"category tag\">Cambridge Global Advisors<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/continuous-diagnostics-and-mitigation\/\" rel=\"category tag\">continuous diagnostics and mitigation<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity-and-infrastructure-security-agency-cisa\/\" rel=\"category tag\">Cybersecurity and Infrastructure Security Agency (CISA)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cyhy\/\" rel=\"category tag\">CyHy<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/department-of-homeland-security-dhs\/\" rel=\"category tag\">Department of Homeland Security (DHS)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/elastic\/\" rel=\"category tag\">Elastic<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/f5\/\" rel=\"category tag\">F5<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/government\/\" rel=\"category tag\">Government<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/government-accountability-office\/\" rel=\"category tag\">Government Accountability Office<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/house-oversight-committee\/\" rel=\"category tag\">House Oversight Committee<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/jeff-greene\/\" rel=\"category tag\">Jeff Greene<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/keeper-security\/\" rel=\"category tag\">Keeper Security<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/matt-hartman\/\" rel=\"category tag\">Matt Hartman<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/office-of-management-and-budget\/\" rel=\"category tag\">office of management and budget<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/policy\/\" rel=\"category tag\">Policy<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/post-quantum-cryptography\/\" rel=\"category tag\">post quantum cryptography<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/qualys\/\" rel=\"category tag\">Qualys<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/sean-connelly\/\" rel=\"category tag\">Sean Connelly<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/shontel-brown\/\" rel=\"category tag\">Shontel Brown<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/zscaler\/\" rel=\"category tag\">Zscaler<\/a>","tag_info":"Zscaler","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=8102"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8102\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=8102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=8102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=8102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":8102,"date":"2025-10-23T05:00:00","date_gmt":"2025-10-23T10:00:00","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=86465"},"modified":"2025-10-23T05:00:00","modified_gmt":"2025-10-23T10:00:00","slug":"f5-vulnerability-highlights-weak-points-in-dhss-cdm-program","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/10\/23\/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program\/","title":{"rendered":"F5 vulnerability highlights weak points in DHS\u2019s CDM program"},"content":{"rendered":"