CVE-2025-53521
Published 2025-10-15 · Updated 2026-10-08 · Source f5sirt@f5.com
Summary
CVE-2025-53521 is a critical-severity (CVSS 9.8) vulnerability in F5 BIG-IP. CISA added it to the Known Exploited Vulnerabilities catalog on March 27, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 30, 2026. CISA does not currently list it as used in ransomware campaigns. F5 has 8 vulnerabilities in the KEV catalog, 4 of them linked to ransomware.
All 8 known-exploited F5 vulnerabilities →Description
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: F5 — BIG-IP
Name: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
Date added: 2026-03-27 · Due: 2026-03-30
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.