CVE-2025-53521
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
Published Oct 15, 2025 · updated Oct 8, 2026 · F5 BIG-IP
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2025 · Catalog
Detected
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Mar 27, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Mar 30, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Oct 8, 2026 · Catalog
Updated
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Mar 30, 2026
Affected
- cpe f5/big-ip access policy managerversion unspecified
- vendor F5 BIG-IPversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2025-53521
F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
cisa.gov - CVE.orgVulnerability recordCVE-2025-53521
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-53521
30-day exploitation probability 2.3%
first.org - NIST NVDVulnerability recordCVE-2025-53521
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
nvd.nist.gov