Log in / Sign up

Vulnerability details

CVE-2025-53521

Actively exploited
F5 BIG-IP

BigIP APM Vulnerability

CVSS 4.0
9.3Critical

Remedy

Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2026-03-30)

Versions not listed as affected in the CVE record:
  • BIG-IP — version 17.5.1.3 and later
  • BIG-IP — version 17.1.3 and later
  • BIG-IP — version 16.1.6.1 and later
  • BIG-IP — version 15.1.10.8 and later

Official description

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS scores

ScoreVersionSourceVector
9.3Critical 4.0 CVEProject cvelistV5 (CNA) (f5) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
9.8Critical 3.1 CVEProject cvelistV5 (CNA) (f5) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
F5 BIG-IP 15.1.0 ≤ v < 15.1.10.8 CVEProject cvelistV5 (CNA)
F5 BIG-IP 16.1.0 ≤ v < 16.1.6.1 CVEProject cvelistV5 (CNA)
F5 BIG-IP 17.1.0 ≤ v < 17.1.3 CVEProject cvelistV5 (CNA)
F5 BIG-IP 17.5.0 ≤ v < 17.5.1.3 CVEProject cvelistV5 (CNA)

References and advisories

2
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2025-10-15
Last updated
2026-03-31
State
Published
Assigner (CNA)
f5
Kolun priority
85 · Critical

CISA KEV catalog

Date added
2026-03-27
Due date
2026-03-30
Used in ransomware
Unknown

Exploit prediction (EPSS)

2.29%
Probability of exploitation in 30 days
83.4%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
Active
Technical impact
Total

Weaknesses (CWE)

  • CWE-121
    Stack-based Buffer Overflow