F5 · BIG-IP
CVE-2025-53521
BigIP APM Vulnerability
What it is
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CISA: F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: March 30, 2026
More exploited flaws from F5
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 10, 2022 | Missing Authentication | BIG-IP | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Traffic Management User Interface (TMUI) Remote Code Execution | BIG-IP | Critical 9.8 | >99.9% |
| Sep 22, 2026 | Heap-based Buffer Overflow | BIG-IP APM | Critical 9.3 | 25% |
| Oct 31, 2023 | Authentication Bypass | BIG-IP Configuration Utility | Critical 9.8 | 97% |
| Oct 31, 2023 | SQL Injection | BIG-IP Configuration Utility | High 8.8 | 4.2% |
| Jan 18, 2022 | Buffer Overflow | BIG-IP Traffic Management Microkernel | Critical 9.8 | 62% |
| Nov 3, 2021 | iControl REST Remote Code Execution | BIG-IP and BIG-IQ Centralized Management | Critical 9.8 | 99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.