Vulnerabilità · 180 giorni fa
CISA ha aggiunto CVE-2025-53521 al suo catalogo Known Exploited Vulnerabilities dopo evidenze di sfruttamento attivo. Il prodotto interessato è F5 BIG-IP Access Policy Manager (APM), il proxy per la gestione degli accessi che si interpone davanti alle applicazioni e applica l'autenticazione. F5 ha pubblicato un aggiornamento che risolve CVE-2025-53521 e il Federal Cybersecurity Executive Board ha ordinato alle agenzie di applicare tale aggiornamento. CISA ha ordinato alle agenzie federali di rimediare entro il 30 marzo 2026.
Sfruttamento noto · CISA KEV
CVSS 9.8 CRITICAL: when a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code… EPSS 2% (82º percentile).
Data di correzione federale CISA 30 mar · data superata
7 fonti che coprono questa storia
Critical flaw in F5 BIG-IP faces wide exploitation risk
The company revised a security advisory as newly disclosed information heightens the potential impact.
5-month-old F5 BIG-IP DoS bug becomes critical RCE exploited in the wild
Reclassified as a remote code execution flaw, the F5 BIG-IP APM vulnerability has been upgraded to CVSS 9.8, requiring immediate patching and compromise assessment.
F5 BIG-IP Vuln Reclassified as RCE, Under Exploitation
CVE-2025-53521 was first disclosed in October as a high-severity denial-of-service (DoS) flaw, but new information reveals the bug is much more dangerous.
F5 BIG-IP Vulnerability Reclassified as RCE, Under Exploitation
CVE-2025-53521 was first disclosed in October as a high-severity denial-of-service (DoS) flaw, but new information reveals the bug is much more dangerous.
Vulnerability affecting F5 BIG-IP APM
The NCSC is encouraging UK organisations to mitigate an unauthenticated remote code execution vulnerability affecting F5 BIG-IP Access Policy Manager.
F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wild
Initially disclosed as a high-severity denial-of-service (DoS), the bug was reclassified as a critical RCE issue.
Hackers exploiting critical F5 BIG-IP flaw in attacks, patch now
F5 has reclassified a BIG-IP APM denial-of-service (DoS) vulnerability as a critical-severity remote code execution (RCE) flaw, warning that attackers are exploiting it to deploy webshells on unpatched devices.
An unauthenticated remote code execution flaw (CVE-2025-53521) in F5's BIG-IP Access Policy Manager (APM) is under active exploitation.
Part of the PlainSec briefing for 2026-04-02