CVE-2025-53521

Published Oct 15, 2025

Last updated a month ago

Exploit known CVSS critical 9.3

BIG-IP APM

BIG-IP

IoT

Supply chain

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-53521 is a vulnerability affecting F5 BIG-IP Access Policy Manager (APM) systems when an access policy is configured on a virtual server. The flaw, categorized as CWE-770 (Allocation of Resources Without Limits or Throttling), allows undisclosed or specially crafted traffic to cause the Traffic Management Microkernel (TMM) process to terminate. This termination of the TMM process results in a disruption of all traffic handled by the BIG-IP device until the process restarts. The vulnerability can be exploited remotely by an unauthenticated attacker, leading to a denial-of-service condition on the BIG-IP APM system.

Description: When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source: f5sirt@f5.com
NVD status: Analyzed
Products: big-ip_access_policy_manager

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: F5 BIG-IP Unspecified Vulnerability
Exploit added on: Mar 27, 2026
Exploit action due: Mar 30, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

f5sirt@f5.com: CWE-121

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A7A0C1CA-EDEF-463F-B7C8-8B9E67239FC1",
            "versionEndExcluding": "15.1.10.8",
            "versionStartIncluding": "15.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6494E2A7-1473-46C0-97F8-90827D9466AA",
            "versionEndExcluding": "16.1.6.1",
            "versionStartIncluding": "16.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "96D35435-27A7-4A88-9432-1F5AB0112B8C",
            "versionEndExcluding": "17.1.3",
            "versionStartIncluding": "17.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "252ED1A4-5F29-4440-B1BA-9621E6791812",
            "versionEndExcluding": "17.5.1.3",
            "versionStartIncluding": "17.5.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.