Loading story…
CISA added CVE-2025-53521 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a flaw in F5 BIG-IP Access Policy Manager (APM). The vulnerability affects BIG-IP 17.x, 16.x, and 15.x when an APM access policy is configured on a virtual server, and specially crafted unauthenticated traffic can crash and restart the TMM process, creating a path to potential root-level remote code execution. F5 had initially treated the issue as a denial-of-service bug, but reclassified it as RCE after new information emerged, sharply raising the severity of the threat.
F5 said fixes were released in February 2025, with patched versions including 17.1.0.4, 16.1.4.3, and 15.1.10.2 or later, and warned that end-of-technical-support systems should be considered unprotected. CISA ordered Federal Civilian Executive Branch agencies covered by BOD 22-01 to remediate by March 30, 2026, while urging organizations to assess internet-exposed F5 devices, review F5-published indicators of compromise and attacker tradecraft, and investigate for signs of intrusion. Reporting also noted the KEV listing comes after F5's earlier nation-state compromise, which allegedly exposed source code and undisclosed vulnerability information.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
As of 2026-03-31, Shadowserver telemetry showed more than 17,100 F5 BIG-IP APM instances exposed globally, with over 14,000 still publicly reachable. The United States and Japan had the highest concentrations of exposed systems amid ongoing exploitation of CVE-2025-53521.
On 2026-03-31, CERT-FR published an alert on CVE-2025-53521 affecting F5 BIG-IP APM after F5 reported active exploitation. The advisory recommended compromise assessments using F5's indicators, including suspicious files, modified binaries, audit log evidence of iControl REST abuse, SELinux tampering, and bash command execution on affected systems.
Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies were required to patch or apply approved mitigations for CVE-2025-53521 by March 30, 2026. The deadline followed CISA's KEV listing of the actively exploited flaw.
On March 28, 2026, CISA added CVE-2025-53521 affecting F5 BIG-IP APM to its Known Exploited Vulnerabilities catalog after confirming exploitation in the wild. CISA also urged organizations to assess exposure and inspect internet-accessible F5 devices for signs of compromise.
In March 2026, F5 confirmed that CVE-2025-53521 was being actively exploited in vulnerable BIG-IP versions. The company published indicators of compromise, attacker tradecraft, and affected and fixed version details.
Based on new information obtained in March 2026, F5 updated its assessment of CVE-2025-53521 from a denial-of-service issue to a remote code execution vulnerability. This significantly raised the severity and potential impact of the flaw.
In August 2025, attackers reportedly breached F5 and stole source code and information on undisclosed vulnerabilities. Reporting linked this compromise to later concern that threat actors may have gained advance insight into exploitable flaws.
F5 released patched BIG-IP versions for CVE-2025-53521 in February 2025, including 17.1.0.4, 16.1.4.3, and 15.1.10.2 or later. The flaw affected BIG-IP 17.x, 16.x, and 15.x when an APM access policy was configured on a virtual server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
13 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecybersecuritynews.com
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcethehackernews.com
Open sourcethecyberthrone.in
Open sourcecvereports.com
Open sourcefacebook.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 BIG-IP Access Policy Manager (APM) contains an actively exploited critical buffer-overflow vulnerability, **CVE-2026-94127** (CVSS 9.8), that enables unauthenticated remote code execution. An attacker can send specially crafted traffic to a vulnerable virtual server configured with both an APM access policy and an OAuth profile; the flaw affects the data plane, including Appliance Mode deployments, but not the control plane. Affected releases include BIG-IP APM 21.1.0, 17.5.x, and 17.1.x versions lacking the applicable engineering hotfixes. F5 and national cyber agencies urge administrators to install the vendor hotfixes immediately; an F5 iRule is available as a temporary mitigation. Defenders should investigate repeated OAuth failures, suspicious commands, and TMM `SIGABRT` crashes using F5’s compromise guidance, while treating any single indicator as insufficient evidence of compromise.
Sep 22, 2026
F5 disclosed a critical flaw in the **BIG-IP iControl REST** interface, tracked as **`CVE-2022-1388`**, that allows attackers to bypass authentication and achieve unauthenticated remote code execution on exposed administrative interfaces. The issue affects the interaction between Apache and the iControl REST service, where crafted requests abusing headers such as **`X-F5-Auth-Token`** and **`Connection`** can reach privileged command-execution functionality without valid credentials. The vulnerability carries a **CVSS 9.8** rating and impacts multiple BIG-IP versions, prompting F5 to publish patches and mitigation guidance. Technical analysis showed the bug stems from request-handling logic that lets specially formed traffic evade normal authentication checks and invoke sensitive endpoints. Security reporting also indicated the flaw was being **actively exploited in the wild**, with thousands of potentially vulnerable internet-exposed BIG-IP systems observed, increasing the risk to organizations using the platform for application delivery and security services. Defenders were urged to patch affected devices quickly or apply F5’s recommended mitigations to restrict exposure of the management interface.
Aug 6, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive requiring all federal agencies to immediately patch critical vulnerabilities in F5 devices and software following the discovery of a nation-state cyber intrusion. CISA identified that a sophisticated threat actor, linked to China, has been actively exploiting vulnerabilities in F5 products, posing an imminent threat to federal networks. The vulnerabilities allow attackers to gain unauthorized access to embedded credentials and API keys, which can be leveraged to move laterally within affected networks. This access enables the exfiltration of sensitive data and the establishment of persistent access, potentially resulting in a full compromise of targeted information systems. F5 disclosed that the threat actor had maintained long-term, persistent access to its BIG-IP development environment and engineering knowledge management platforms, leading to the exfiltration of files. CISA’s Emergency Directive 26-01 mandates that all Federal Civilian Executive Branch (FCEB) agencies apply the latest vendor-provided updates to at-risk F5 devices and software, including F5OS, BIG-IP TMOS, BIG-IQ, and BNK / CNF, by October 22, 2025. Agencies are also instructed to follow F5’s Quarterly Security Notification for further mitigation steps. The directive was issued despite ongoing challenges such as a government shutdown and the lapse of the Cybersecurity Information Sharing Act of 2015, underscoring the urgency and severity of the threat. CISA’s acting director emphasized the alarming ease with which these vulnerabilities can be exploited and warned that the risks extend beyond federal agencies to any organization using F5 technology. The agency highlighted the potential for catastrophic compromise of critical information systems if the vulnerabilities are not addressed promptly. The directive is part of a broader effort to protect federal networks from nation-state adversaries and to ensure the security of sensitive government data. CISA’s response follows a pattern of nation-state actors targeting widely used enterprise technologies to gain access to high-value networks. The agency’s public statements and technical guidance stress the importance of immediate action and cross-sector vigilance. F5’s own disclosures and cooperation with CISA have been critical in identifying the scope of the intrusion and the necessary remediation steps. The incident has raised concerns about the security of supply chains and the potential for similar attacks on other technology vendors. Federal agencies are being closely monitored for compliance with the directive, and CISA is providing ongoing support and threat intelligence updates. The event highlights the persistent and evolving nature of nation-state cyber threats targeting critical infrastructure and government systems.
Jun 29, 2026