F5 BIG-IP APM Flaw CVE-2025-53521 Exploited in the Wild

THE THREAT

On March 27th, 2026, F5 confirmed exploitation of a previously known vulnerability in its BIG-IP Access Policy Manager (APM) versions. The flaw, tracked as CVE-2025-53521 (CVSS: 9.3), allows an unauthenticated attacker to achieve Remote Code Execution (RCE) on BIG-IP APM systems configured on virtual servers.

Given the severity and confirmed exploitation of CVE-2025-53521, it is recommended that organizations ensure that the BIG-IP APM systems are upgraded to a secure version.

What we're doing about it

• eSentire's Managed Vulnerability Service (MVS) can identify devices vulnerable to CVE-2025-53521
• eSentire's Threat Response Unit (TRU) has developed threat detections within MDR for Network and is actively evaluating threat detection capabilities within MDR for Log
• eSentire's TRU is actively tracking the topic for additional details and new detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches
• Review the Indicators of Compromise (IoCs) provided by F5 to identify potential exploitation of CVE-2025-53521
• If a compromise is suspected, organizations should notify eSentire and follow the F5 guidelines
• To defend against such threats, follow the security best practices for F5 products

Additional information

CVE-2025-53521 was originally disclosed in October 2025 as a Denial-of-Service (DoS) vulnerability with a CVSS score of 7.5. On March 28th, 2026, F5 revised its security advisory, noting that based on recent exploitation activity, the vulnerability has been reclassified as a RCE issue with a higher CVSS score, reflecting its increased severity. In a related security advisory released on March 27th, F5 reported that attackers had been observed deploying a webshell in memory and provided associated IoCs.

The impact of this flaw has not been assessed for End-of-Technical Support (EoTS) versions. Organizations operating on these versions are advised to upgrade to BIG-IP APM's secure versionsincluding, 17.1.3, 17.5.1.3, 16.1.6.1, or 15.1.10.8. As per F5, the flaw resides in the "apmd" process of the impacted versions. Organizations still using impacted versions and those that have upgraded to fixed versions are recommended to review the provided IoCs. This includes checking BIG-IP APM system log entries for suspicious activity associated with a local user, presence of malicious files on the disk, and suspicious HTTP/S traffic potentially hiding attacker activity. If organizations suspect a compromise, they are recommended to refer to F5's guidelines.

CISA added CVE-2025-53521 to its Known Exploited Vulnerabilities (KEV) catalog on March 27th, mandating federal agencies to mitigate the flaw by March 30th. The recategorization of the flaw as RCE vulnerability, combined with CISA's accelerated remediation timeline, highlights the severity of the vulnerability. The threat actors behind the activity and their objectives have not yet been identified. Exploitation of the vulnerability to deploy a webshell could enable further payload delivery, persistence, and lateral movement within affected networks. Given the potential impact, it is critical that organizations upgrade to secure versions of BIG-IP APM.

Impacted Versions List:

• BIG-IP APM version 17.1.0-17.1.2
• BIG-IP APM version 17.5.0-17.5.1
• BIG-IP APM version 16.1.0-16.1.6
• BIG-IP APM version 15.1.0-15.1.10

References:
[1] https://my.f5.com/manage/s/article/K000160486
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-53521
[3] https://my.f5.com/manage/s/article/K11438344
[4] https://community.f5.com/kb/technicalarticles/security-best-practices-for-f5-products/302468
[5] https://my.f5.com/manage/s/article/K000156741
[6] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53521