CVE-2025-53521

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 2.2%; technical severity is CVSS 9.3.

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Who should care

• Teams operating BIG-IP, Big-ip Access Policy Manager
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether BIG-IP, Big-ip Access Policy Manager is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. F5 Security advisory K000156741
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE

CWE-121

Affected versions

F5 BIG-IP; F5 Big-ip Access Policy Manager (Start Including 15.1.0, End Excluding 15.1.10.8 | Start Including 16.1.0, End Excluding 16.1.6.1 | Start Including 17.1.0, End Excluding 17.1.3 | Start Including 17.5.0, End Excluding 17.5.1.3)

Fixed versions

F5 Big-ip Access Policy Manager (Fixed from 15.1.10.8, 16.1.6.1, 17.1.3, 17.5.1.3)

Published

15 October 2025

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 15 Oct 2025CVE published
2. 26 Mar 2026Added to CISA KEV
3. 21 Aug 2026Latest EPSS score: 2.2%
4. 19 Aug 2026 · 12:58 UTCSignal calculated at 67

External references

• CISA Government advisory CVE-2025-53521 ↗