Vulnerability intelligence
CVE-2025-53521
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score
9.8
Critical
EPSS — Exploit Probability
2.3%
Riskier than 83% of all CVEs · checked 2026-10-17
Exploitation
Confirmed in the wild
KEV since 2026-03-27
Remediation
Patch available
Federal deadline 2026-03-30
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-30.
13 articles across 10 outlets · first covered Mar 31, 2026 · latest Sep 9, 2026
Associated threat actors
Coverage timeline
-
Fileless PoisonedRefresh Rootkit Targets F5 BIG-IP APM Systemssecurityaffairs.com · Sep 9, 2026
-
F5 BIG-IP Flaw Hid In-Memory Web Shells from Disk Scansthehackernews.com · Sep 9, 2026
-
Stealth Linux Rootkit Targets F5 BIG-IP Appliances via RCEsecurityonline.info · Sep 7, 2026
-
F5 BIGIP APM Servers Exposed as CVE-2025-53521 Actively Exploitedsecurityaffairs.com · Apr 6, 2026
-
CVE-2025-53521: F5 BIG-IP APM Flaw Reclassified as Unauthenticated RCEsocradar.io · Apr 1, 2026
-
NCSC Urges Immediate Patching of F5 BIG-IP Bugwww.infosecurity-magazine.com · Mar 31, 2026
-
Fortinet BIG-IP Vulnerability Reclassified as RCE, Under Exploitationwww.darkreading.com · Mar 30, 2026
-
Vulnerability affecting F5 BIG-IP APMwww.ncsc.gov.uk · Mar 30, 2026
-
F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wildwww.securityweek.com · Mar 30, 2026
-
U.S. CISA adds a flaw in F5 BIG-IP AMP to its Known Exploited Vulnerabilities catalogsecurityaffairs.com · Mar 28, 2026
-
CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitationthehackernews.com · Mar 28, 2026
-
CISA Adds CVE-2025-53521 to Known Exploited Vulnerabilities Cataloguewww.cisa.gov · Mar 28, 2026
-
CISA Adds CVE-2025-53521 to Known Exploited Vulnerabilities Cataloguecisa.gov · Mar 27, 2026