Database/Control plane, storage & DevOps

F5 BIG-IP (APM access policy): Specific malicious traffic against a virtual server with a BIG-IP APM access policy

CVSS 9.8CVE-2025-53521Control plane, storage & DevOpsKnown exploitedK000156741curated

Impact

Specific malicious traffic against a virtual server with a BIG-IP APM access policy configured leads to remote code execution. This is part of F5's October 2025 mass-remediation advisory issued after the nation-state breach of F5's internal systems and BIG-IP source code, and it's confirmed in CISA's KEV catalog — treat any internet- or cluster-VPN-facing BIG-IP APM instance as a priority target.

Who can reach it

Remote, against a virtual server that has an APM access policy applied — F5 has not disclosed full exploitation prerequisites, consistent with a critical RCE that's actively tracked as exploited.

What to do

Software upgrade to the fixed BIG-IP version per F5 K000156741, then reboot/failover. Because this is part of the breach-remediation batch, treat the whole BIG-IP estate as needing review — not just this one CVE — and prioritize any unit that's End of Technical Support, since F5 does not evaluate or patch those.

References

https://my.f5.com/manage/s/article/K000156741 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.