CVE-2025-53521

Think of BIG-IP as a front door and traffic controller that helps your business manage access to apps and services. This bug lets someone send special network traffic to cause the device to run malicious code without logging in—and the same event can also crash or disrupt the service.

This matters if you run F5 BIG-IP (including BIG-IP APM access policy management and related BIG-IP modules) and you have a BIG-IP APM access policy configured on a virtual server. The risk is specifically that a remote attacker can reach the affected network behavior; exploitation does not require a login or user interaction. If attackers can send crafted traffic to that configured virtual server, your exposure is real.

This is RED because CISA confirmed it’s an actively addressed, real-world risk (it’s in CISA KEV) and reporting indicates attackers have compromised BIG-IP APM devices using this weakness. The impact is not just theoretical: exploitation has led to deployed malware and persistent access, and the flaw can also cause denial of service.

Confirm whether you’re exposed

1. Check configuration: Verify whether BIG-IP APM has an access policy configured on a virtual server.
2. Check version: Record your current F5 BIG-IP software version.
3. Check reachability: Identify which virtual server(s) are publicly reachable (or reachable from untrusted networks) and match them to your APM access-policy configuration.

Patch to a fixed version

Patch to one of the fixed versions below (these are the fixed versions across the affected BIG-IP and listed module names):

• 17.5.1.3
• 17.1.3
• 16.1.6.1
• 15.1.10.8

If you can’t patch immediately

1. Apply F5 mitigations from the vendor remediation article referenced in the advisory: K000156741.
2. As directed by F5 guidance, reduce exposure for the relevant virtual server endpoints (for example, restrict who can send traffic to the affected listener(s)).

Incident-readiness checks after patching

1. Review logs on the BIG-IP device for unusual activity around the time of exposure.
2. Look for indicators of compromise consistent with reported in-memory malware activity (the reporting describes fileless techniques like web shells and system component tampering).
3. Validate that APM access policies are still functioning as expected and that only the intended traffic is allowed.

Timing note (CISA due date)

• CISA KEV remediation due date for applying mitigations/updates is 2026-03-30.

What to monitor

• Continued APM/virtual-server traffic patterns and error rates (for denial-of-service symptoms).
• BIG-IP system changes and suspicious process/script behavior consistent with malicious persistence.

What’s happening

• Weakness type: CWE-770 (Insufficient Input Validation).
• Mechanism: When BIG-IP APM access policy is configured on a virtual server, specially crafted network traffic can trigger remote code execution, which can then cause denial of service.

Exploitation status

• CISA KEV: Yes; added 2026-03-27 with remediation due 2026-03-30.
• In-the-wild exploitation: Confirmed by reporting; attackers reportedly breached BIG-IP APM devices and deployed malware including a Linux rootkit and an in-memory web shell (described as “PoisonedRefresh”) designed to evade disk scans and maintain persistence.
• Exploit availability: No public exploit code was found in the provided findings.

Risk drivers for small businesses

• No authentication required and no user interaction: this lowers the attacker’s barrier.
• Network attack vector: the device is reachable over the network where your virtual server is exposed.

Fixed versions

• BIG-IP fixed in 17.5.1.3, 17.1.3, 16.1.6.1, 15.1.10.8 (and corresponding module fixes per the advisory).

EPSS note

• EPSS is a prediction; however, CISA KEV listing and real-world exploitation reporting should be treated as the primary urgency signal.