CRITICAL

CVE-2025-53521

F5 Big Ip Access Policy Manager 2025-10-15 CVSS v3.1

CVSS

9.8

KEV

Description

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Summary dbcve.org

A remote code execution vulnerability in F5 BIG-IP APM (Access Policy Manager) allows attackers to execute arbitrary code on the underlying system by sending specific malicious traffic to virtual servers that have an access policy configured. This is a pre-authentication RCE with critical severity.

Mitigation

Apply the available F5 security patch for CVE-2025-53521; if no patch is available, restrict network access to affected virtual servers or disable the APM access policy until a fix can be deployed.

Weakness (CWE)

CWE-121 Stack-based Buffer Overflow

EPSS Score

2.3%

Probability of exploitation in next 30 days

82.5th percentile

References

https://my.f5.com/manage/s/article/K000156741 Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE