CVE-2025-53521

What it actually does

CVE-2025-53521 is a network-reachable remote code execution vulnerability in F5 BIG-IP Access Policy Manager when an APM access policy is configured on a virtual server. The issue is classified as a buffer overflow and can be triggered by specially crafted traffic sent to an affected virtual server. Because exploitation requires no authentication, no user interaction, and low attack complexity, a successful attacker can execute code on the BIG-IP system with high impact to confidentiality, integrity, and availability of the appliance and the services it fronts.

Why it matters to the business

Successful exploitation can compromise a BIG-IP device that often sits in front of critical applications, VPN, identity-aware access, or remote access workflows. An attacker could disrupt application delivery, steal session or access-related data, alter traffic handling, establish persistence on the appliance, or use the device as a foothold into downstream networks. This vulnerability is listed in CISA KEV with active exploitation observed in the wild and a remediation due date of 2026-03-30, so exposed systems should be treated as a high-priority operational risk even though the current EPSS score is relatively low. The threat context includes public reporting tied to F5 BIG-IP exploitation and an Interlock ransomware campaign reference, increasing concern for post-exploitation activity and extortion-driven follow-on actions.

How an attack unfolds

An attacker first identifies an internet-facing or otherwise reachable BIG-IP virtual server that has an APM access policy enabled. They then send crafted network traffic to the affected virtual server that exercises the vulnerable APM processing path and triggers a buffer overflow. If exploitation succeeds, the attacker gains the ability to run commands or payloads on the BIG-IP system. From there, typical follow-on behavior may include enumerating device configuration, reading authentication or access policy data, modifying traffic or access controls, dropping temporary tooling or web-accessible files, creating persistence, proxying into internal services, or disrupting application delivery. Because exploitation has been observed in the wild and the appliance may be positioned at a network boundary, organizations should assume that successful exploitation can rapidly become both an infrastructure compromise and an access-brokerage event.

How to fix it

Upgrade affected BIG-IP Access Policy Manager deployments to a vendor-supported fixed release or hotfix as directed by the F5 security advisory for CVE-2025-53521. No exact fixed versions were provided in the input, so administrators should validate the applicable target version directly against F5’s advisory matrix for their BIG-IP branch. Systems running End of Technical Support versions should not be considered evaluated or safe; migrate them to a supported fixed release. As interim risk reduction, restrict network access to affected virtual servers where possible, remove or disable APM access policies from virtual servers that do not require them, limit exposure to trusted source networks, enforce upstream filtering or WAF controls for suspicious traffic, and ensure management interfaces are not internet-accessible. After patching, reboot or fail over appliances as required by the vendor instructions and verify HA pairs or device groups are consistently remediated.

How to confirm the fix worked

Confirm exposure by inventorying BIG-IP devices and identifying virtual servers with APM access policies enabled. Validate the installed BIG-IP version and hotfix level using the Configuration utility or tmsh commands such as `tmsh show sys version`, then compare the result with the F5 advisory for this vulnerability. Review virtual server configuration for APM profiles or access policies using `tmsh list ltm virtual` and related APM profile/policy configuration commands. Confirm remediation by verifying the system reports a vendor-supported fixed version or applicable hotfix, confirming all HA peers are upgraded, and confirming no affected APM-enabled virtual servers remain on vulnerable software. Where scanning is used, prefer authenticated version/configuration checks over exploit-based testing; do not validate by sending live exploit traffic to production systems.

Typical attack path

1. Scan for F5 BIG-IP systems exposing virtual servers that use Access Policy Manager functionality.
2. Confirm that an APM access policy is reachable on a target virtual server.
3. Send specially crafted traffic to trigger the vulnerable buffer overflow condition.
4. Achieve unauthenticated remote code execution on the BIG-IP appliance.
5. Run reconnaissance commands to identify BIG-IP version, configuration, network reachability, users, policies, and attached applications.
6. Deploy temporary tooling, persistence mechanisms, or web-accessible payloads if write access is obtained.
7. Use the BIG-IP device as a pivot point to monitor, alter, or relay traffic to protected applications and internal services.
8. Exfiltrate configuration, access-related data, credentials, tokens, or session material where available.
9. Cover tracks by deleting temporary files, rotating logs, or modifying timestamps.

How to detect it

To determine whether exploitation has already occurred, review BIG-IP system, APM, audit, and local shell logs for abnormal traffic followed by command execution, file writes, configuration changes, new accounts, service restarts, or outbound network activity. Key log sources include `/var/log/apm`, `/var/log/ltm`, `/var/log/audit`, `/var/log/secure`, `/var/log/messages`, shell histories for administrative accounts, configuration change history, and network telemetry from the BIG-IP management and self-IP addresses. Look for unexpected files in temporary and web-accessible directories, unusual child processes spawned by BIG-IP services, reverse-shell utilities, downloads via curl or wget, archive staging, and outbound connections to unfamiliar hosts. Correlate suspected exploitation attempts against spikes in APM errors, TMM/APM crashes, malformed request handling, or unexplained failovers/restarts. Because active exploitation is reported and threat context includes F5 BIG-IP exploitation and Interlock ransomware campaign references, also hunt for follow-on behaviors such as credential access, lateral movement attempts, proxying through the appliance, and configuration exfiltration. Absence of a single signature should not be treated as proof of safety; this vulnerability may have multiple exploit implementations.

• /var/log/apm
• /var/log/ltm
• /var/log/audit
• /var/log/secure
• /var/log/messages
• /var/tmp/
• /shared/tmp/
• /tmp/
• /usr/local/www/
• /config/bigip.conf
• /config/bigip_base.conf
• /config/BigDB.dat
• /root/.bash_history
• /home/admin/.bash_history
• bash -c
• /bin/sh -c
• curl http
• curl -k
• wget http
• nc -e
• ncat -e
• python -c
• perl -e
• chmod +x
• tmsh create auth user
• tmsh modify auth user
• tmsh save sys ucs

What your security team should do

• Treat internet-facing BIG-IP APM virtual servers as urgent patching targets because the vulnerability is unauthenticated RCE, KEV-listed, and actively exploited in the wild.
• Prioritize any BIG-IP device with APM access policies enabled, especially those exposed to the internet, partner networks, VPN users, or untrusted client populations.
• Verify whether each BIG-IP device is on a supported branch; plan immediate migration for End of Technical Support versions because they may not have been evaluated or fixed.
• Apply the F5-recommended fixed release or hotfix, then confirm HA/device-group consistency and failover health.
• If immediate patching is not possible, reduce exposure by restricting source IP ranges, disabling unnecessary APM policies, and applying compensating controls at upstream network and application layers.
• Hunt for post-exploitation artifacts on BIG-IP systems, including unexpected files in temporary or web directories, suspicious shell activity, outbound connections, new administrative users, and unexplained configuration changes.
• Review logs back to at least the publication date, and longer where feasible, because the vulnerability is older than 299 days and active exploitation is reported.
• Monitor for threat activity associated with F5 BIG-IP exploitation and ransomware-adjacent campaigns, including Interlock-related tradecraft where applicable.
• Preserve forensic evidence before rebuilding or patching if compromise is suspected, including BIG-IP logs, UCS/config backups, file listings, process listings, network connections, and audit history.