Search/CVE-2025-53521
● CVE — Critical

CVE-2025-53521

Vendorf5Productbig-ip access policy managerDiscoveredOct 15, 2025UpdatedMar 31, 2026

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

View graph Watch Export
CVSS v3.1
9.8 CRITICAL
EPSS
2.30%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
5
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Sep 16, 2026
▲ 0.08pp
2.21% → 2.30% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
10 relationships
Timeline
disclosure → media coverage
Oct 15, 2025
Disclosure — published as a CVE record. · last revised by NVD Mar 31, 2026
Mar 28, 2026
thehackernews.com reports: CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation
Mar 28, 2026
helpnetsecurity.com reports: Attackers are exploiting RCE vulnerability in BIG-IP APM systems (CVE-2025-53521)
Mar 30, 2026
darkreading.com reports: Fortinet BIG-IP Vulnerability Reclassified as RCE, Under Exploitation
Mar 31, 2026
infosecurity-magazine.com reports: NCSC Urges Immediate Patching of F5 BIG-IP Bug
Sep 23, 2026
thehackernews.com reports: F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers