CVE-2025-53521

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-53521 9.8

F5 · BIG-IP · Added 2026-03-27 · Published 2025-10-15

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityF5 BIG-IP Stack-Based Buffer Overflow Vulnerability

VendorF5

ProductBIG-IP

Date added2026-03-27

Due date2026-03-30

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-121

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.

NVD: When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-06-12 19:02 UTC

Wall time45.0s

Searches4

Component defaultno

Sources https://my.f5.com/manage/s/article/K000156741
https://my.f5.com/manage/s/article/K000160486
https://www.ncsc.gov.uk/news/vulnerability-affecting-f5-big-ip-apm
https://www.helpnetsecurity.com/2026/03/28/big-ip-apm-vulnerability-cve-2025-53521-exploited/
https://arcticwolf.com/resources/blog/cve-2025-53521/
https://socradar.io/blog/cve-2025-53521-f5-big-ip-apm-flaw-rce/
https://nvd.nist.gov/vuln/detail/CVE-2025-53521

QC notes

warn component_extraction: Component 'BIG-IP Access Policy Manager (APM) apmd process when an access policy is configured on a virtual server' matches or contains product name 'BIG-IP' — no specific component identified

Hunting hypothesis agent

Monitor for oversized or specifically crafted network traffic targeting F5 BIG-IP APM virtual server endpoints that could trigger a stack-based buffer overflow in the access policy management handler.

Research details

ComponentBIG-IP Access Policy Manager (APM) apmd process when an access policy is configured on a virtual server

PreconditionsTarget must run a vulnerable BIG-IP APM version: 15.1.0 through 15.1.10, 16.1.0 through 16.1.6, 17.1.0 through 17.1.2, or 17.5.0 through 17.5.1. An APM access policy must be configured and enabled on a network-reachable virtual server. Appliance mode systems are also vulnerable. Only the data plane is affected (no control plane exposure). No authentication required. agent

DeliveryAttackers send specifically crafted network traffic to a BIG-IP virtual server with an APM access policy configured. The crafted traffic triggers a stack-based buffer overflow in the apmd process (the Traffic Management Microkernel's access policy daemon), enabling unauthenticated remote code execution on the data plane. Post-exploitation activities include webshell deployment, SELinux disablement, and installation of the Brickstorm backdoor for persistent access.

Public PoCno

Advisoryhttps://my.f5.com/manage/s/article/K000156741

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Reclassified from DoS to RCE in March 2026 after active exploitation discovered. Linked to China-nexus threat group UNC5221 who accessed F5 source code. No public PoC available, but exploitation is confirmed active with indicators of compromise documented by F5 (K000160486).

SummaryCVE-2025-53521 is a critical stack-based buffer overflow (CWE-121) vulnerability in the F5 BIG-IP Access Policy Manager (APM) apmd process, exploitable by unauthenticated attackers when an APM access policy is configured on a virtual server. Originally disclosed as a denial-of-service issue in October 2025, it was reclassified to remote code execution (CVSS 9.8) in March 2026 after evidence of active exploitation by the China-nexus threat group UNC5221, who reportedly accessed F5 source code and weaponized undisclosed vulnerabilities. CISA added it to the KEV catalog on March 27, 2026, with a remediation deadline of March 30, 2026, and F5 has published detailed indicators of compromise (K000160486) associated with malicious software c05d5254.

Tia coverage

First reported2026-09-07

First exploit report2026-09-08

Exploit report → KEV165 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit-htt poisonedrefresh-malware-backdoors-f5-big-ip-servers-with-memory

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.