CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation
Summary: CISA added CVE-2025-53521, a flaw in F5 BIG-IP Access Policy Manager, to its Known Exploited Vulnerabilities catalog on Friday, citing evidence of active exploitation. The vulnerability carries a CVSS v4 score of 9.3 and allows remote code execution; F5 reclassified it from a denial-of-service issue (CVSS v4 8.7) after new information obtained in March 2026, and confirmed it has been exploited in vulnerable BIG-IP versions.
Key Takeaway: F5 reported webshells written to disk that operate in memory only, so the files on disk may show no modification - meaning a compromised BIG-IP APM may not look compromised. Federal Civilian Executive Branch agencies have until March 30, 2026, to apply fixes, and Defused Cyber reports acute scanning activity against the F5 BIG-IP REST API endpoint /mgmt/shared/identified-devices/config/device-info.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-53521
- Related
- CVE-2025-53521: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Mar 27, 2026