F5 BIG-IP APM flaw reclassified as critical RCE with active exploitation
F5 reclassified CVE-2025-53521 in BIG-IP Access Policy Manager (APM) from a denial-of-service vulnerability to unauthenticated remote code execution (RCE). BIG-IP APM is a centralized access management proxy that controls network and application access. The vulnerability allows attackers to execute code remotely on unpatched systems with access policies configured on virtual servers, without any authentication.
Shadowserver found over 14,000 BIG-IP APM instances exposed online that remain vulnerable. F5 confirmed active exploitation and published indicators of compromise. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this CVE to its Known Exploited Vulnerabilities catalog and set a patch deadline that has now passed.
Many operators likely deprioritized patching when the flaw was classified as DoS. The reclassification and active exploitation mean the risk is now critical. Teams must verify their BIG-IP APM versions and patch immediately or isolate vulnerable,
CVSS 9.8 CRITICAL: when a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code… EPSS 2% (82nd percentile).
CISA federal remediation date Mar 30 · date passed
Over 14,000 F5 BIG-IP APM instances still exposed to RCE attacks
Internet security watchdog Shadowserver has found over 14,000 BIG-IP APM instances exposed online amid ongoing attacks exploiting a critical-severity remote code execution (RCE) vulnerability.