CVE-2025-53521criticalunder attackCWE-121

CVE-2025-53521: critical vulnerability in F5 BIG-IP

BigIP APM Vulnerability

Published · Updated

58Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.3epss 2.3%
from disclosure to weapon
Published on NVDOct 15
CISA KEV+163d
exploitation probability
2.3%top 17% of all CVEs
observed exploitation
yesCISA + VulnCheck
Action required by CISAfederal deadline: 2026-03-30

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A flaw in F5 BIG-IP's APM (Access Policy Manager) allows attackers to run malicious code remotely on affected servers when certain traffic patterns are sent. This is a critical vulnerability because it gives attackers complete control over the system.

Technical detail

A stack-based buffer overflow (CWE-121) in BIG-IP APM's access policy processing allows unauthenticated remote code execution when specially crafted traffic is sent to a virtual server with APM enabled. The vulnerability requires no authentication or user interaction and can be exploited with network-level access to the vulnerable interface.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
F5 · BIG-IP
Related CVEs — F5 BIG-IP

In the same product, most dangerous first.

CVE-2022-1388CRITICALCVE-2022-1388EPSS 100.0%KEVCVE-2023-46747CRITICALBIG-IP Configuration utility unauthenticated remote code execution vulnerabilityEPSS 96.5%KEVCVE-2023-46748HIGHBIG-IP Configuration utility authenticated SQL injection vulnerabilityEPSS 4.5%KEVCVE-2026-94127CRITICALBIG-IP APM OAuth vulnerabilityEPSS 2.2%KEVCVE-2022-41622HIGHiControl SOAP vulnerabilityEPSS 92.4%CVE-2022-41800HIGHAppliance mode iControl REST vulnerabilityEPSS 76.9%
References
https://my.f5.com/manage/s/article/K000156741https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521