CVE-2025-53521KEV · OVERDUECWE-121

F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

Critical · published October 15, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 83.1th percentile for exploit probability.

209
days past CISA
deadline
CVSS v3.1
9.8
EPSS
2%
Percentile
83.1
In the wild
Confirmed
What it is

🚨 A crafty attacker can hijack your server with just a well-timed malicious request! This vulnerability in BIG-IP APM access policy can lead to full Remote Code Execution (RCE) — that's a big deal! 🔥 Think of it like a sneaky delivery driver who gets access to your building because they have a fake package slip. They can walk right in through the virtual front door and take whatever they want, potentially wreaking havoc on your systems. An attacker leveraging this vulnerability could execute arbitrary code on your server, leading to data breaches, unauthorized access, and possibly complete control over your infrastructure. Picture a data thief roaming freely through your sensitive files—absolutely devastating for any organization!

Put simply

Think of it like a sneaky delivery driver who gets access to your building because they have a fake package slip. They can walk right in through the virtual front door and take whatever they want, potentially wreaking havoc on your systems. This RCE vulnerability occurs when a BIG-IP APM access policy is configured on a virtual server, allowing malicious traffic to execute untrusted code due to improper input validation.

What to do

An attacker leveraging this vulnerability could execute arbitrary code on your server, leading to data breaches, unauthorized access, and possibly complete control over your infrastructure. Picture a data thief roaming freely through your sensitive files—absolutely devastating for any organization! Immediately patch to the latest version of BIG-IP to close this critical vulnerability. Review your access policies and traffic settings to ensure they are configured securely. Don't forget to monitor your logs for any suspicious activity! You've got this! With quick action, you can protect your system from this threat and earn your security hero badge! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02295 · 83.1th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2025-10-15T18:15Z
KEV added
2026-03-27 · due 2026-03-30
Affected products (4)
ProductVersionsFixed in
f5/big-ip_access_policy_manager≥ 15.1.0, < 15.1.10.815.1.10.8
f5/big-ip_access_policy_manager≥ 16.1.0, < 16.1.6.116.1.6.1
f5/big-ip_access_policy_manager≥ 17.1.0, < 17.1.317.1.3
f5/big-ip_access_policy_manager≥ 17.5.0, < 17.5.1.317.5.1.3
References (2)
EPSS history
Timeline
  • 27 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 30
    kev
  • 15 OCT 13:55Z
    BigIP APM Vulnerability
    cvelistv5