F5 BIG-IP APM RCE exploitation and response

**CVE-2025-53521** is being **actively exploited** against **F5 BIG-IP APM** deployments, creating **unauthenticated remote code execution** risk for exposed systems. The flaw affects BIG-IP APM systems with an **access policy configured on a virtual server**, including **Appliance mode**. F5 says fixed releases are available, and **CISA** has added the CVE to its **Known Exploited Vulnerabilities** list. Organizations should prioritize patching because the weakness has already been abused in the wild.

As of **2026-04-02**, ongoing attacks are exploiting **CVE-2025-53521** against **F5 BIG-IP APM** systems, leaving more than **14,000** exposed online and at risk of remote code execution. F5 said the flaw was reclassified from **DoS** to **RCE** after new information in **March 2026**, and **CISA** has added it to its **actively exploited** list. The exploitation wave targets unpatched systems with access policies configured on a virtual server, which makes internet-facing deployments especially risky.

F5 disclosed a nation-state intrusion that compromised BIG-IP development systems and related engineering knowledge-management resources. The intrusion was first detected on August 9, 2025 and publicly disclosed on October 15, 2025. Files taken in the incident included portions of BIG-IP source code and information about undisclosed vulnerabilities. Investigators described long-term, persistent access and said the company rotated credentials, strengthened access controls, expanded monitoring, and engaged external responders including Google Mandiant and CrowdStrike. F5 also reported that there was no evidence of malicious exploitation of the vulnerabilities and no new unauthorized activity after containment efforts. Some exfiltrated knowledge-management files may have contained customer configuration or implementation information for a small percentage of customers. The company also said other core systems such as CRM, financial, support case management, and iHealth were not reached.

CISA added **CVE-2025-53521** to its **KEV catalog** and told **federal agencies** to patch the F5 BIG-IP flaw within **three days**. The directive is urgent because the bug is being **exploited in the wild** and can enable **unauthenticated remote code execution**. F5 says the issue affects **BIG-IP APM** deployments with an access policy configured on a virtual server, and fixed releases are available.