CISA ha aggiunto CVE-2025-53521 al catalogo Known Exploited Vulnerabilities. La vulnerabilità permette una RCE non autenticata in F5 BIG‑IP Access Policy Manager (APM) ed è sotto sfruttamento attivo. Colpisce versioni 17.5, 17.1, 16.1 e 15.1 di BIG‑IP APM.
CVSS 9.8 CRITICAL: when a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code… EPSS 2% (82º percentile).
Data di correzione federale CISA 30 mar · data superata
F5 BIG-IP Vulnerability Reclassified as RCE, Under Exploitation
CVE-2025-53521 was first disclosed in October as a high-severity denial-of-service (DoS) flaw, but new information reveals the bug is much more dangerous.
5-month-old F5 BIG-IP DoS bug becomes critical RCE exploited in the wild
Reclassified as a remote code execution flaw, the F5 BIG-IP APM vulnerability has been upgraded to CVSS 9.8, requiring immediate patching and compromise assessment.