RCE Vulnerability - Attackers Exploit F5 BIG-IP APM Flaw
Basically, hackers can take control of systems using a serious flaw in F5's software.
A critical vulnerability in F5's BIG-IP APM is under active attack. Organizations using affected versions are at risk of severe breaches. Immediate patching is essential to protect systems.
The Flaw
F5's BIG-IP Access Policy Manager (APM) has a critical unauthenticated remote code execution vulnerability identified as CVE-2025-53521. This flaw allows attackers to execute arbitrary code on affected systems, posing a significant risk to enterprises, financial institutions, and government organizations. The vulnerability affects versions 17.5.0 to 17.5.1, 17.1.0 to 17.1.2, 16.1.0 to 16.1.6, and 15.1.0 to 15.1.10 of BIG-IP APM. Initially thought to only cause denial of service, new findings have reclassified it as a remote code execution threat with a CVSS score of 9.8.
What's at Risk
Organizations using the vulnerable versions of BIG-IP APM are at high risk. Attackers can exploit this vulnerability to gain unauthorized access, potentially leading to data breaches and system compromises. F5 has indicated that the flaw can be exploited through malicious traffic directed at a configured access policy on a virtual server. This means that without proper defenses, attackers can take control of critical systems.
Patch Status
F5 released patches for the vulnerability in October 2025, which effectively mitigate the risk if applied promptly. However, the US Cybersecurity and Infrastructure Security Agency (CISA) has warned that exploitation of the flaw is currently active. Organizations that have not updated their systems may have already been compromised, as the advisory does not specify when exploitation began. Customers are urged to check their systems for indicators of compromise, including specific file changes and unusual traffic patterns.
Immediate Actions
Organizations should prioritize updating their BIG-IP APM systems to the latest patched versions. F5 has provided a list of indicators of compromise to help organizations identify potential breaches. These include monitoring for specific files, log entries, and modifications to system integrity checkers. CISA has mandated that US federal agencies assess their exposure and take necessary actions by March 30, 2026. Failure to act could lead to severe consequences, including unauthorized access and data loss.
Help Net Security