CVE-2025-53521
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability - [Actively Exploited]
Description
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
INFO
Published Date :
Oct. 15, 2025, 2:15 p.m.
Last Modified :
March 31, 2026, 5:12 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Unknown
Please adhere to F5’s guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible F5 products affected by this vulnerability. For more information please see: https://my.f5.com/manage/s/article/K000156741 ; https://my.f5.com/manage/s/article/K000160486 ; https://my.f5.com/manage/s/article/K11438344 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53521
Affected Products
The following products are affected by CVE-2025-53521
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 4.0 | HIGH | 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab | ||||
| CVSS 4.0 | HIGH | [email protected] | ||||
| CVSS 4.0 | CRITICAL | [email protected] |
Solution
- Apply the latest available BIG-IP software update.
- Consult the vendor for specific upgrade instructions.
- Test the updated system thoroughly.
Public PoC/Exploit Available at Github
CVE-2025-53521 has a 3 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-53521.
| URL | Resource |
|---|---|
| https://my.f5.com/manage/s/article/K000156741 | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521 | US Government Resource |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-53521 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-53521
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Security Tracker
Python
AI POWERED ADVANCED THREAT INTEL PLATFORM
cyberdudebivash cyberdudebivashecosystem
Python Dockerfile JavaScript HTML Shell Batchfile PowerShell YARA Procfile PLpgSQL
None
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-53521 vulnerability anywhere in the article.
-
The Hacker News
Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS
Fortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-35616 (CVSS score: ... Read more
-
The Hacker News
China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing
A China-aligned threat actor has set its sights on European government and diplomatic organizations since mid-2025, following a two-year period of minimal targeting in the region. The campaign has bee ... Read more
-
CybersecurityNews
14,000+ F5 BIG-IP APM Exposed Online as Attackers Actively Exploiting RCE Vulnerability
A critical security flaw in F5’s BIG-IP Access Policy Manager (APM) is currently under active exploitation, leaving thousands of enterprise networks at risk. The vulnerability, officially tracked as C ... Read more
-
The Hacker News
Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials
A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Serv ... Read more
-
The Hacker News
Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise
Cisco has released updates to address a critical security flaw in the Integrated Management Controller (IMC) that, if successfully exploited, could allow an unauthenticated, remote attacker to bypass ... Read more
-
The Hacker News
ThreatsDay Bulletin: Pre-Auth Chains, Android Rootkits, CloudTrail Evasion & 10 More Stories
The latest ThreatsDay Bulletin is basically a cheat sheet for everything breaking on the internet right now. No corporate fluff or boring lectures here, just a quick and honest look at the messy reali ... Read more
-
security.nl
Ruim veertienduizend F5 BIG-IP APM-servers toegankelijk vanaf internet
Ruim veertienduizend F5 BIG-IP APM-servers zijn toegankelijk vanaf internet, zo meldt The Shadowserver Foundation. Aanvallers maken actief misbruik van een kwetsbaarheid in het platform. Het is nog on ... Read more
-
The Hacker News
New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch Released
Google on Thursday released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild. The high-severity vulnerab ... Read more
-
The Hacker News
TrueConf Zero-Day Exploited in Attacks on Southeast Asian Government Networks
A high-severity security flaw in the TrueConf client video conferencing software has been exploited in the wild as a zero-day as part of a campaign targeting government entities in Southeast Asia dubb ... Read more
-
security.nl
Amerikaanse overheid krijgt drie dagen voor installatie Citrix- en F5-updates
Federale Amerikaanse overheidsdiensten moeten beveiligingsupdates voor twee actief aangevallen kwetsbaarheden in producten van Citrix en F5 binnen drie dagen installeren. Het Amerikaanse cyberagentsch ... Read more
-
Hackread - Cybersecurity News, Data Breaches, AI and More
Critical F5 BIG-IP Flaw Upgraded to 9.8 RCE, Exploited in the Wild
Cybersecurity researchers at F5 have issued an urgent warning regarding a severe security flaw affecting their BIG-IP APM systems. Originally, the issue was dismissed as a minor technical glitch, but ... Read more
-
Help Net Security
Critical Fortinet FortiClient EMS bug under active attack (CVE-2026-21643)
A critical SQL injection vulnerability (CVE-2026-21643) in Fortinet FortiClient Endpoint Management Server (EMS), a management server for FortiClient endpoint agents on various platforms, is under act ... Read more
-
Daily CyberSecurity
The CVE Watchtower: Weekly Threat Intelligence Briefing (March 23 – March 29, 2026)
Whether you are steering the organizational ship as a CISO or maintaining the operational engines as a system administrator, cutting through the noise of weekly vulnerabilities is essential to keeping ... Read more
-
Help Net Security
Week in review: NIST updates DNS security guidance, compromised LiteLLM PyPI packages
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: NIST updates its DNS security guidance for the first time in over a decade DNS infrastructure underpin ... Read more
-
Daily CyberSecurity
CISA Issues Three-Days Patch Mandate for Critical 9.8 F5 BIG-IP RCE
The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical Remote Code Execution (RCE) vulnerability affecting F5 BIG-IP systems to its Known Exploited Vulnerabilities ... Read more
-
CybersecurityNews
CISA Warns of F5 BIG-IP Vulnerability Actively Exploited in Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a newly disclosed vulnerability affecting F5 BIG-IP systems to its Known Exploited Vulnerabilities (KEV) catalog, warning tha ... Read more
-
Help Net Security
Attackers are exploiting RCE vulnerability in BIG-IP APM systems (CVE-2025-53521)
A critical unauthenticated remote code execution vulnerability (CVE-2025-53521) in F5’s BIG-IP Access Policy Manager (APM) solution is under active exploitation, the US Cybersecurity and Infrastructur ... Read more
-
security.nl
NCSC waarschuwt voor actief misbruik van kritiek beveiligingslek in F5 BIG-IP
Het Nationaal Cyber Security Centrum (NCSC) waarschuwt organisaties voor actief misbruik van een kritieke kwetsbaarheid in F5 BIG-IP-producten waardoor remote code execution mogelijk is. F5 kwam afgel ... Read more
-
The Hacker News
CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical security flaw impacting F5 BIG-IP Access Policy Manager (APM) to its Known Exploited Vulnerabilities (KEV) c ... Read more
-
TheCyberThrone
CISA Adds CVE-2025-53521 F5 BIG-IP APM to KEV
CISA has added CVE-2025-53521 to its Known Exploited Vulnerabilities catalog, designating it as actively exploited in the wild. Federal agencies under BOD 22-01 have until March 30, 2026 to patch or i ... Read more
The following table lists the changes that have been made to the
CVE-2025-53521 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Modified Analysis by [email protected]
Mar. 31, 2026
Action Type Old Value New Value Removed CPE Configuration OR *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 Removed CPE Configuration OR *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 Changed CPE Configuration OR *cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 OR *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (excluding) 17.5.1.3 *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 -
CVE Modified by [email protected]
Mar. 31, 2026
Action Type Old Value New Value Added CWE CWE-121 Removed CWE CWE-770 -
Modified Analysis by [email protected]
Mar. 27, 2026
Action Type Old Value New Value Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521 Types: US Government Resource -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Mar. 27, 2026
Action Type Old Value New Value Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521 -
CVE Modified by [email protected]
Mar. 27, 2026
Action Type Old Value New Value Changed Description When a BIG-IP APM Access Policy is configured on a virtual server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Removed CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Removed CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H -
Initial Analysis by [email protected]
Oct. 21, 2025
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 *cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (excluding) 15.1.10.8 Added CPE Configuration OR *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 *cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (excluding) 16.1.6.1 Added CPE Configuration OR *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 *cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (excluding) 17.1.3 *cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* versions from (including) 17.5.0 up to (including) 17.5.1 Added Reference Type F5 Networks: https://my.f5.com/manage/s/article/K000156741 Types: Vendor Advisory -
New CVE Received by [email protected]
Oct. 15, 2025
Action Type Old Value New Value Added Description When a BIG-IP APM Access Policy is configured on a virtual server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-770 Added Reference https://my.f5.com/manage/s/article/K000156741