Critical RCE in F5 BIG‑IP APM (CVE‑2025‑53521) Actively Exploited – Immediate Patch Required
What It Is — A remote‑code‑execution (RCE) flaw in F5 Networks’ BIG‑IP Access Policy Manager (APM) was assigned CVE‑2025‑53521. The vulnerability allows unauthenticated attackers to execute arbitrary code on the appliance, effectively taking control of the underlying system.
Exploitability — Public proof‑of‑concept code and real‑world exploitation have been observed in the wild. The CVSS v3.1 base score is 9.8 (Critical).
Affected Products — F5 BIG‑IP APM appliances running versions prior to the 9.8 security update (including 9.7.x and earlier).
TPRM Impact — Many enterprises rely on BIG‑IP for load balancing, SSL termination, and secure access to internal applications. A compromised appliance can be leveraged to pivot into downstream services, exfiltrate data, or disrupt critical business functions, representing a high‑impact supply‑chain risk for third‑party vendors and their customers.
Recommended Actions —
- Deploy the F5 9.8 security patch immediately on all affected BIG‑IP APM instances.
- Verify patch installation and confirm the absence of the vulnerable code path.
- Apply available IoC signatures and hunt for indicators of compromise in network and host logs.
- Segment the management interface of BIG‑IP devices from untrusted networks and enforce strict access controls.
- Review and harden configuration settings (e.g., disable unnecessary services, enforce MFA for admin accounts).
Source: HackRead – Critical F5 BIG‑IP Flaw Upgraded to 9.8 RCE, Exploited in the Wild