CISA ha aggiunto CVE-2025-53521 al catalogo Known Exploited Vulnerabilities dopo evidenze di sfruttamento attivo. F5 ha riclassificato la falla da DoS a RCE non autenticata che interessa multiple versioni di BIG-IP APM, inclusa Appliance mode. F5 ha pubblicato indicatori di compromissione e CISA ha ordinato l'applicazione della patch FCEB entro il 30 marzo 2026.
CVSS 9.8 CRITICAL: when a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code… EPSS 2% (82º percentile).
Data di correzione federale CISA 30 mar · data superata
F5 BIG-IP Vulnerability Reclassified as RCE, Under Exploitation
CVE-2025-53521 was first disclosed in October as a high-severity denial-of-service (DoS) flaw, but new information reveals the bug is much more dangerous.
5-month-old F5 BIG-IP DoS bug becomes critical RCE exploited in the wild
Reclassified as a remote code execution flaw, the F5 BIG-IP APM vulnerability has been upgraded to CVSS 9.8, requiring immediate patching and compromise assessment.