F5 BIG-IP RCE Vulnerability (CVE-2025-53521)

CISA ICS-CERT Advisories

Published March 28th, 2026

Detected March 28th, 2026

Summary

CISA has issued a notice regarding a critical RCE vulnerability (CVE-2025-53521) in F5 BIG-IP APM. The vulnerability has a CVSS score of 9.8 and is actively exploited. Affected versions require immediate attention.

View original document View source feed page

What changed

CISA has added CVE-2025-53521 to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation of a critical Remote Code Execution (RCE) vulnerability in F5 BIG-IP APM. The vulnerability, with a CVSS score of 9.8, arises when a BIG-IP APM access policy is configured on a virtual server, allowing specific malicious traffic to trigger RCE. Affected versions include specific releases within the 17.5, 17.1, 16.1, and 15.1 product lines.

Organizations utilizing F5 BIG-IP APM with the specified configurations must immediately review their systems. CISA's inclusion in the KEV catalog implies a significant threat, and immediate patching or mitigation is strongly advised. Refer to the F5 Networks vendor advisory (K000156741) for precise version details and recommended remediation steps to prevent exploitation.

What to do next

Review F5 BIG-IP APM configurations for affected versions.
Apply vendor-provided patches or implement mitigations as per F5 Networks advisory K000156741.
Monitor systems for signs of exploitation.

Source document (simplified)

Required CVE Record Information

CNA: F5 Networks

Description

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CWE 1 Total

Learn more
- CWE-770: CWE-770 Allocation of Resources Without Limits or Throttling

CVSS 2 Total

Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 9.8 | CRITICAL | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 9.3 | CRITICAL | 4.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |

Product Status

Learn more Versions 4 Total

Default Status: unknown

affected

affected from 17.5.0 before 17.5.1.3
affected from 17.1.0 before 17.1.3
affected from 16.1.0 before 16.1.6.1
affected from 15.1.0 before 15.1.10.8

Credits

F5 finder

References 1 Total

https://my.f5.com/manage/s/article/K000156741 vendor-advisory

Authorized Data Publishers

Learn more

CISA-ADP

Updated:

2026-03-28

SSVC and KEV, plus CVSS and CWE if not provided by the CNA.

SSVC 1 Total

Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| active | yes | total | 2.0.3 | 2025-10-15 |