🔴 CRITICAL
Severity Overview
- CVSS Base Score: 9.3
- Severity: CRITICAL
- CVSS Version: 4.0
- Priority: Critical priority
Summary
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Â
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Analyst Takeaway
This vulnerability is already in CISA KEV, which means exploitation has been observed in the wild and the issue should be treated as active risk rather than theoretical exposure. The CVSS score places this in critical territory, so internet-facing systems and high-value assets should be prioritized for immediate remediation or compensating controls. F5 BIG-IP is associated with technology that is commonly deployed in enterprise environments, so defenders should assume a higher probability of broad target interest and prioritize validation across the environment. The ATT&CK mapping suggests public-facing exploitation risk, so external exposure validation should be part of immediate triage. In parallel with patching, defenders should review external exposure, hunt for signs of exploitation, and validate whether compensating controls are in place for vulnerable assets.
MITRE ATT&CK Mapping
- T1190 – Exploit Public-Facing Application
Rationale: The product appears likely to be internet-facing or commonly exposed in enterprise environments.
Detection Guidance
-
T1190 – Exploit Public-Facing Application
- Inspect web server, reverse proxy, load balancer, and WAF logs for abnormal requests.
- Look for unusual requests to uncommon URIs, exploit strings, or suspicious POST activity.
- Monitor for spikes in HTTP 4xx/5xx responses that may indicate probing or failed exploitation attempts.
- Review outbound connections from affected servers for unexpected command-and-control or secondary payload retrieval.
- Validate which internet-facing assets are running the vulnerable product and whether compensating controls exist.
Hunting Considerations
- Search SIEM and EDR data for activity aligned to the mapped ATT&CK techniques.
- Correlate endpoint, network, identity, and application telemetry for signs of exploitation and post-exploitation behavior.
- Prioritize internet-facing systems, externally reachable management interfaces, and assets handling sensitive data.
- Investigate unexpected process creation, service changes, outbound connections, or authentication anomalies on affected hosts.
Key Details
- CVE: CVE-2025-53521
- Vendor: F5
- Product: BIG-IP
- CWE: CWE-770
- Date Added to CISA KEV: 2026-03-27
- CISA Due Date: 2026-03-30
- Known Ransomware Campaign Use: Unknown
Technical Severity Details
- CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Why This Matters
This vulnerability is included in CISA’s Known Exploited Vulnerabilities catalog, which means exploitation has been observed in the wild. Based on the available NVD scoring, this issue should be treated as critical priority.
Recommended Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Additional Notes
Please adhere to F5’s guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible F5 products affected by this vulnerability. For more information please see: https://my.f5.com/manage/s/article/K000156741 ; https://my.f5.com/manage/s/article/K000160486 ; https://my.f5.com/manage/s/article/K11438344 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53521