CVE-2025-53521

Published Oct 15, 2025

Last updated 2 days ago

Overview

Description
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source
f5sirt@f5.com
NVD status
Analyzed
Products
big-ip_access_policy_manager, big-ip_advanced_firewall_manager, big-ip_advanced_web_application_firewall, big-ip_analytics, big-ip_application_acceleration_manager, big-ip_application_security_manager, big-ip_application_visibility_and_reporting, big-ip_automation_toolchain, big-ip_carrier-grade_nat, big-ip_container_ingress_services, big-ip_ddos_hybrid_defender, big-ip_domain_name_system, big-ip_edge_gateway, big-ip_fraud_protection_service, big-ip_global_traffic_manager, big-ip_link_controller, big-ip_local_traffic_manager, big-ip_policy_enforcement_manager, big-ip_ssl_orchestrator, big-ip_webaccelerator, big-ip_websafe

Risk scores

CVSS 4.0

Type
Secondary
Base score
9.3
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
CRITICAL

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

f5sirt@f5.com
CWE-770

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

28

  1. CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation https://t.co/2sF4DZzB2a #neuco

    @neucogroup

    29 Mar 2026

    22 Impressions

    2 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  2. CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation https://t.co/s9w27BVzP5

    @DeepBlueInfoSec

    29 Mar 2026

    21 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CISA warns of active exploitation of F5 BIG-IP vulnerability CVE-2025-53521. Organizations urged to apply patches immediately to prevent potential breaches. Link: https://t.co/cFP2aA2tR3 #Security #Vulnerability #Exploitation #Mitigation #Patch #Breach #CISA #Technology #Network

    @dailytechonx

    29 Mar 2026

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. CISA Urges Immediate Action on CVE-2025-53521 Following Active Exploitation https://t.co/9UiCvD8RC5 #CISA #cybersecurity #vulnerability #exploitation #threat #security #CVE #protection #alert #hacking #network #breach #IT #technology #risk #safety #mitigation #attack #response

    @dailytechonx

    29 Mar 2026

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. CISA added CVE-2025-53521 in F5 BIG-IP APM to KEV with a short remediation clock. For local governments, that makes this a same-day perimeter risk decision—not routine patch debt. Confirm exposure, patch status, and ownership now. https://t.co/8TqOzJeiql

    @Cyb3r_Leo

    29 Mar 2026

    50 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  6. Intel Report [CRITICAL] - A critical unauthenticated remote code execution vulnerability (CVE-2025-53521) in F5 BIG-IP Access Policy Manager (APM) is under active exploitation, prompting CISA to add it to the Known Exploited Vulnerabilities (KEV)... https://t.co/lQiYBepMPz

    @EnigmaGlobalSW

    29 Mar 2026

    55 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  7. CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation https://t.co/GZBaQVxeSG

    @JedisecX

    29 Mar 2026

    54 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. SMBs, a quick heads-up: F5 BIG-IP has an actively exploited vulnerability (CVE-2025-53521) now in KEV. Check if your gateways are exposed, apply patches, and watch for unusual traffic. Don’t wait for a breach—prep your patch window. Details: https://t.co/CYRgvFMOjm

    @StrongKeepCyber

    29 Mar 2026

    69 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  9. Top 5 Trending CVEs: 1 - CVE-2020-5902 2 - CVE-2026-33634 3 - CVE-2025-31277 4 - CVE-2026-20643 5 - CVE-2025-53521 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W

    @CVEShield

    29 Mar 2026

    99 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  10. CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation https://t.co/080GKrWtWB

    @PVynckier

    29 Mar 2026

    121 Impressions

    3 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  11. [0-DAY] THE BRICKSTORM BREACH: CVSS 9.8 RCE (CVE-2025-53521) https://t.co/RRuROEYtIt https://t.co/B0OTFY0MtO

    @invasive_labs

    29 Mar 2026

    20 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  12. CISA adds F5 BIG-IP RCE (CVE-2025-53521) to its KEV Catalog. With a 9.8 CVSS score and active exploits, federal agencies must patch by March 30, 2026. #F5 #BIGIP #CyberSecurity #InfoSec #RCE #CISA #PatchAlert #Vulnerability #NetworkSecurity #CVE https://t.co/s05axhTOQH https://t

    @the_yellow_fall

    29 Mar 2026

    911 Impressions

    4 Retweets

    18 Likes

    8 Bookmarks

    0 Replies

    1 Quote

  13. SMBs, take note: attackers are already exploiting CVE-2025-53521 in F5 BIG-IP APM. Patch now, verify access controls, and monitor logs for odd activity. Don’t panic—just patch, segment, and review your gateway exposure. Read more: https://t.co/yyVg3Weepb

    @StrongKeepCyber

    29 Mar 2026

    93 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  14. CISA adds CVE-2025-53521 (F5 BIG-IP APM, CVSS 9.3) to KEV catalog due to active exploitation. It allows remote code execution—urgent patch recommended! #cybersecurity https://t.co/AphuGHzVsx

    @technoholic_me

    29 Mar 2026

    89 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  15. ⚠️ CISA KEV ALERT: CVE-2025-53521 in F5 BIG-IP APM just added to the Known Exploited Vulnerabilities catalog. CVSS 9.3 | Remote Code Execution | No user interaction required. If you're running BIG-IP APM — patch timeline was yesterday. #CISA #F5 #RCE #InfoSec #CyberSecur

    @isectech_

    28 Mar 2026

    124 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  16. TRC analysis shows attackers exploiting CVE-2025-53521 in F5 BIG-IP APM to terminate critical Traffic Management processes without authentication. Post-compromise activity includes lateral movement and C2 establishment. Runtime segmentation helps contain breach chains after

    @aviatrixtrc

    28 Mar 2026

    125 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  17. CISA Warns of F5 BIG-IP Vulnerability Actively Exploited in Attacks - Cyber Security News https://t.co/MciRWe6e90 "The vulnerability, tracked as CVE-2025-53521, was officially listed on March 27, 2026, with a remediation deadline of March 30, 2026, for federal agencies."

    @catnap707

    28 Mar 2026

    255 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  18. CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation https://t.co/NLEs9X7h93

    @TechNowPulse

    28 Mar 2026

    116 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  19. #CISA Adds CVE-2025-53521 to #KEV After Active F5 BIG-IP #APM #Exploitation https://t.co/k74fJ8EUom https://t.co/dewhczlTm3

    @omvapt

    28 Mar 2026

    109 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  20. CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation https://t.co/5iyfc2FPH8

    @Hackervidya

    28 Mar 2026

    96 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  21. 🚨 F5 BIG-IP APM RCE (CVE-2025-53521): Actively exploited auth bypass + code exec on access proxies. Hits enterprise networks hard—CISA adds to KEV, urgent patching needed. https://t.co/huymlNaCBy

    @TheRabbitPy

    28 Mar 2026

    121 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  22. TRC analysis shows attackers exploiting CVE-2025-53521 to crash F5 BIG-IP's Traffic Management Microkernel, creating DoS conditions that enable privilege escalation and lateral movement. Runtime segmentation helps contain post-compromise activity when APM systems fail. #ZeroTrust

    @aviatrixtrc

    28 Mar 2026

    100 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  23. 🚨 **تنبيه أمني عاجل لمستخدمي أنظمة F5 BIG-IP** أصدرت وكالة الأمن السيبراني وأمن البنية التحتية الأمريكية (CISA) تحذيرًا عالي الخطورة بشأن ثغرة أمنية مكتشفة حدي

    @cyber_shockry

    28 Mar 2026

    99 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  24. CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation https://t.co/vTzUvIM1xb via @TheHackersNews

    @ABabino

    28 Mar 2026

    87 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  25. [BREAKING] CISA adds F5 BIG-IP CVE-2025-53521 to KEV catalog after confirming active exploitation on March 27, 2026 CISA on March 27, 2026, added CVE-2025-53521—a critical remote code execution flaw in F5 BIG-IP Access Policy Manager—to its Known Exploited Vulnerabilities h

    @DarkForgeNews

    28 Mar 2026

    90 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  26. CISAがCVE-2025-53521をKEVに追加し悪用が確認、重要なのは既に実際の攻撃で利用されている脆弱性として優先対応が必要な点 この脆弱性は実環境での悪用が観測され、政府機関や組織に対し期限付きでのパッチ

    @01ra66it

    28 Mar 2026

    472 Impressions

    0 Retweets

    4 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  27. ⚠️ CISA flags active exploitation of F5 BIG-IP flaw (CVE-2025-53521) enabling RCE. High risk for lateral movement & data theft. Patch now. Details: https://t.co/pMXVFMEqCF… #CyberSecurity https://t.co/1w7eZj6cjb

    @7thGensec

    28 Mar 2026

    108 Impressions

    2 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  28. CISA added CVE-2025-53521, a critical vulnerability in F5 BIG-IP APM, to its Known Exploited Vulnerabilities catalog due to active exploitation. This flaw allows remote code execution (RCE) and affects versions 15.1.0 to 17.5. https://t.co/45YNR8Vzm9

    @securityRSS

    28 Mar 2026

    92 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  29. Attackers are exploiting RCE vulnerability in BIG-IP APM systems (CVE-2025-53521) - Help Net Security - https://t.co/UPKVTw6fkT

    @moton

    28 Mar 2026

    70 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  30. 📌 تحذير NCSC من استغلال لثغرة أمنية حرجة في F5 BIG-IP أصدر المركز الوطني للأمن السيبراني (NCSC) تحذيرًا بشأن استغلال نشط لثغرة أمنية حرجة (CVE-2025-53521) تؤثر على منتجا

    @MisbarSec

    28 Mar 2026

    278 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  31. 🚨 Urgent Alert! CISA has added CVE-2025-53521 to its KEV catalog due to active exploitation of F5 BIG-IP APM. If you use F5 BIG-IP APM, patch immediately to secure your systems! #CyberSecurity #F5BIGIP https://t.co/ioXxuvAOWC

    @xcybersecnews

    28 Mar 2026

    67 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  32. 米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。(3/27追加) 🛡️No.1555 CVE-2025-53521 F5 BIG-IP Remote Code Execution Vulnerability ==================================== ✅概要 ・深刻度:緊急🔥 9.3 (CVSS Base) / NVD

    @piyokango

    28 Mar 2026

    4603 Impressions

    3 Retweets

    13 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  33. 🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: Attackers are exploiting RCE vulnerability in BIG-IP APM systems (CVE-2025-53521) Intel Report: https://t.co/FHbBlNx0el

    @cyberbivash

    28 Mar 2026

    62 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  34. 🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation Intel Report: https://t.co/1vbJZtIjnB

    @cyberbivash

    28 Mar 2026

    64 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  35. CISA has added CVE-2025-53521, a critical remote code execution flaw in F5 BIG-IP Access Policy Manager, to its Known Exploited Vulnerabilities catalog. https://t.co/FByxRCeXUM #CyberSecurity #F5BIGIP #CISA #KEV #RCE #Vulnerability #PatchNow #InfoSec #NetworkSecurity https://t.

    @redsecuretech

    28 Mar 2026

    79 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  36. BREAKING: CISA adds actively exploited F5 BIG-IP APM RCE bug CVE-2025-53521 (CVSS 9.8) to KEV catalog after nation-state breach, unauthenticated attackers can run arbitrary code. https://t.co/IgB0A0MJ8X

    @threatcluster

    28 Mar 2026

    101 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  37. CISA adds CVE-2025-53521, a critical F5 BIG-IP APM flaw enabling pre-auth remote code execution (CVSS 9.3), to KEV after active exploitation. F5 updates TTPs and requires patches by 2026. #F5Security #Vulnerability #USA https://t.co/GRODEEpGlL

    @TweetThreatNews

    28 Mar 2026

    177 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  38. 🔴 Cautious · 🛡️ Safety 🚨 CISA Flags F5 BIG-IP APM Vulnerability After Active Exploitation 🔗 Source: The Hacker News The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-53521, affecting F5's BIG-IP APM, to its Known Exploited Vulner

    @ElSapoLabs

    28 Mar 2026

    80 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  39. CISAが既知の悪用された脆弱性を1件カタログに追加 https://t.co/SDcHBlUqPW CVE-2025-53521 F5 BIG-IPのリモートコード実行の脆弱性

    @cybersecnews_jp

    28 Mar 2026

    84 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  40. CISA ADICIONA CVE-2025-53521 AO KEV APÓS EXPLORAÇÃO ATIVA DO F5 BIG-IP APM https://t.co/gu1BY5d5lk #SamirNews #cisa #adiciona #cve202553521 #ao #kev #após #exploração #ativa #do #f5 #bigip #apm

    @CanalFs0ciety

    28 Mar 2026

    89 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  41. 🚨 Atenção! A vulnerabilidade CVE-2025-53521 no F5 BIG-IP APM pode permitir a execução remota de código por atacantes. 🛡️ Aplique as mitigations conforme instruções do fornecedor ou descontinue o uso do produto. Fique seguro! #CyberSecurity #InfoSec #CVE

    @fernandokarl

    28 Mar 2026

    82 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  42. Mar 28, 2026 🚨 CISA has added CVE-2025-53521 to its KEV catalog due to active exploitation of a critical flaw in F5 BIG-IP APM, allowing remote code execution. Stay vigilant! https://t.co/8ZfbZA0O7s

    @kernyx64

    28 Mar 2026

    86 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  43. Attackers are exploiting RCE vulnerability in BIG-IP APM systems (CVE-2025-53521) https://t.co/P0evm0sdTm

    @TheCyberSecHub

    28 Mar 2026

    698 Impressions

    4 Retweets

    6 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  44. CISA added F5 BIG-IP APM vulnerability (CVE-2025-53521, CVSS 9.3) to KEV catalog. Active exploitation confirmed. Originally classified as DoS, reclassified to RCE. Federal patch deadline set. #cybersecurity https://t.co/y3SZQrLxI5

    @battista212

    28 Mar 2026

    93 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  45. Attackers are exploiting RCE vulnerability in BIG-IP #APM #systems (#CVE-2025-53521) https://t.co/11WXyGtxmS

    @ScyScan

    28 Mar 2026

    86 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  46. CISA Adds Critical F5 BIG-IP CVE-2025-53521 to KEV Catalog #cve202553521 #f5bigip #remotecodeexecution https://t.co/JR6BXZIEHw

    @Anavem_

    28 Mar 2026

    80 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  47. Attackers are exploiting RCE vulnerability in BIG-IP APM systems (CVE-2025-53521) - https://t.co/6eXjNsiDpm - @CISACyber @F5 #BIGIP #AccessManagement #AccessControl #Enterprise #Vulnerability #Exploited #CybersecurityNews #InfosecNew

    @helpnetsecurity

    28 Mar 2026

    405 Impressions

    0 Retweets

    4 Likes

    1 Bookmark

    1 Reply

    0 Quotes

  48. [HelpNet] Attackers are exploiting RCE vulnerability in BIG-IP APM systems (CVE-2025-53521). A critical unauthenticated remote code execution vulnerability (CVE-2025-53521) in F5’s BIG-IP Access Policy Manager (APM) solution is under active... https://t.co/y7UhXTyfJt

    @shah_sheikh

    28 Mar 2026

    86 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  49. A critical unauthenticated remote code execution vulnerability (CVE-2025-53521) in F5’s BIG-IP Access Policy Manager (APM) solution is under active exploitation, the US Cybersecurity and Infrastructure… https://t.co/H6j5BdTSIY #CyberSecurity #RCE #Vulnerability #CVE2025 #F5BI

    @vtbcfeed

    28 Mar 2026

    78 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  50. 🚨 F5 BIG-IPにRCE脆弱性! CISAがCVE-2025-53521をKEVに追加。Activeな悪用が確認されています!BIG-IP APMの脆弱性により、リモートでコードが実行されるリスク⚠️ 対策済みですか?早急なアップデートを推奨します

    @motch_dev

    28 Mar 2026

    110 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

Configurations