F5 BIG-IP APM - Over 14,000 Instances Exposed to RCE Attacks
Basically, many F5 devices are open to attacks that let hackers run harmful code remotely.
A critical RCE vulnerability exposes over 14,000 F5 BIG-IP APM instances. Organizations must act quickly to secure their systems against potential attacks. F5 has issued guidance to help mitigate risks.
What Happened
Internet security watchdog Shadowserver has reported that over 14,000 F5 BIG-IP APM instances are still exposed online. This exposure is due to a critical-severity remote code execution (RCE) vulnerability, tracked as CVE-2025-53521. Initially disclosed as a denial-of-service (DoS) flaw in October 2025, it was recently reclassified as an RCE vulnerability after new information emerged in March 2026.
Who's Affected
F5 BIG-IP APM (Access Policy Manager) is widely used for centralized access management. It helps organizations secure access to networks, applications, and APIs. With over 17,100 IPs identified with BIG-IP APM fingerprints, many organizations are at risk if they have not patched their systems. This includes a significant number of federal agencies, as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated that these systems be secured immediately.
What Data Was Exposed
The vulnerability allows attackers to gain remote code execution on unpatched BIG-IP APM systems. This means that unauthorized users can execute malicious code, potentially leading to data breaches, system hijacking, or deployment of malware. The exact number of affected instances with vulnerable configurations remains unclear, but the risk is substantial.
What You Should Do
F5 has issued guidance for organizations to secure their systems. Here are key steps:
- Check for Malicious Activity: Review logs and terminal history for any signs of compromise.
- Rebuild Affected Systems: If evidence of compromise is found, F5 recommends rebuilding systems from a known good source, as backups may contain malware.
- Stay Updated: Ensure that all systems are patched to the latest version to mitigate risks associated with this vulnerability.
F5 has also shared indicators of compromise (IOCs) to help organizations identify potential breaches. The urgency to act is critical, as the longer these systems remain exposed, the greater the risk of exploitation by threat actors, including nation-state and cybercrime groups.
Conclusion
The ongoing threat posed by the CVE-2025-53521 vulnerability highlights the importance of timely updates and vigilance in cybersecurity practices. Organizations must prioritize securing their F5 BIG-IP APM instances to protect against remote code execution attacks.