Active exploitation of F5 BIG-IP RCE vulnerability CVE-2025-53521
Summary
Hide ▲
Show ▼
Threat actors are actively exploiting a critical remote code execution (RCE) vulnerability in F5 BIG-IP Access Policy Manager (APM) systems, previously disclosed as a denial-of-service (DoS) issue in October 2025. The flaw, assigned CVE-2025-53521 (CVSS 9.3), enables unauthenticated attackers to execute arbitrary code on vulnerable BIG-IP systems with access policies configured on virtual servers or in Appliance mode. The issue is classified as a data plane vulnerability with no control plane exposure. Impacted versions include BIG-IP APM releases 17.5.0–17.5.1, 17.1.0–17.1.2, 16.1.0–16.1.6, and 15.1.0–15.1.10. The vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to remediate within three days. Exploitation has been confirmed in the wild, with F5 validating that patches for the original CVE remediation address the RCE in fixed versions.
Timeline
-
30.03.2026 10:07 1 articles · 2h ago
F5 BIG-IP APM RCE vulnerability CVE-2025-53521 exploited in the wild
Threat actors are actively exploiting CVE-2025-53521, a critical RCE vulnerability in F5 BIG-IP APM systems, with exploitation confirmed in vulnerable versions 17.5.0–17.5.1, 17.1.0–17.1.2, 16.1.0–16.1.6, and 15.1.0–15.1.10. The flaw enables unauthenticated code execution on systems with access policies configured on virtual servers or in Appliance mode, and has been added to CISA’s KEV catalog with a three-day remediation deadline for federal agencies. F5 has validated that patches address the RCE and published IOCs for detection.
Show sources
- F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wild — www.securityweek.com — 30.03.2026 10:07
Information Snippets
-
CVE-2025-53521 was initially disclosed in October 2025 as a high-severity DoS vulnerability but was reclassified as a critical RCE flaw in March 2026.
First reported: 30.03.2026 10:071 source, 1 articleShow sources
- F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wild — www.securityweek.com — 30.03.2026 10:07
-
The vulnerability affects F5 BIG-IP APM systems running versions 17.5.0–17.5.1, 17.1.0–17.1.2, 16.1.0–16.1.6, and 15.1.0–15.1.10.
First reported: 30.03.2026 10:071 source, 1 articleShow sources
- F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wild — www.securityweek.com — 30.03.2026 10:07
-
Fixed versions addressing the RCE include BIG-IP APM 17.5.1.3, 17.1.3, 16.1.6.1, and 15.1.10.8.
First reported: 30.03.2026 10:071 source, 1 articleShow sources
- F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wild — www.securityweek.com — 30.03.2026 10:07
-
Exploitation requires an access policy configured on a virtual server or systems operating in Appliance mode; the issue is a data plane vulnerability with no control plane exposure.
First reported: 30.03.2026 10:071 source, 1 articleShow sources
- F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wild — www.securityweek.com — 30.03.2026 10:07
-
CISA added CVE-2025-53521 to its Known Exploited Vulnerabilities (KEV) catalog on March 28, 2026, requiring federal agencies to patch within three days.
First reported: 30.03.2026 10:071 source, 1 articleShow sources
- F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wild — www.securityweek.com — 30.03.2026 10:07
-
F5 has published indicators of compromise (IOCs) for malicious activity, including rogue files, hash mismatches, timestamp anomalies, and specific log entries or command outputs on compromised systems.
First reported: 30.03.2026 10:071 source, 1 articleShow sources
- F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wild — www.securityweek.com — 30.03.2026 10:07