Vulnerabilities · 166 days ago
CISA added CVE-2025-53521 in F5 BIG-IP Access Policy Manager to its Known Exploited Vulnerabilities catalog after evidence of active exploitation.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: when a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code… EPSS 2% (82nd percentile).
CISA federal remediation date Mar 30 · date passed
7 sources covering this story
Critical flaw in F5 BIG-IP faces wide exploitation risk
The company revised a security advisory as newly disclosed information heightens the potential impact.
5-month-old F5 BIG-IP DoS bug becomes critical RCE exploited in the wild
Reclassified as a remote code execution flaw, the F5 BIG-IP APM vulnerability has been upgraded to CVSS 9.8, requiring immediate patching and compromise assessment.
F5 BIG-IP Vuln Reclassified as RCE, Under Exploitation
CVE-2025-53521 was first disclosed in October as a high-severity denial-of-service (DoS) flaw, but new information reveals the bug is much more dangerous.
F5 BIG-IP Vulnerability Reclassified as RCE, Under Exploitation
CVE-2025-53521 was first disclosed in October as a high-severity denial-of-service (DoS) flaw, but new information reveals the bug is much more dangerous.
Vulnerability affecting F5 BIG-IP APM
The NCSC is encouraging UK organisations to mitigate an unauthenticated remote code execution vulnerability affecting F5 BIG-IP Access Policy Manager.
F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wild
Initially disclosed as a high-severity denial-of-service (DoS), the bug was reclassified as a critical RCE issue.
Hackers exploiting critical F5 BIG-IP flaw in attacks, patch now
F5 has reclassified a BIG-IP APM denial-of-service (DoS) vulnerability as a critical-severity remote code execution (RCE) flaw, warning that attackers are exploiting it to deploy webshells on unpatched devices.
An unauthenticated remote code execution flaw (CVE-2025-53521) in F5's BIG-IP Access Policy Manager (APM) is under active exploitation.
Part of the PlainSec briefing for 2026-04-02