What’s Vulnerable › Vulnerabilities

CVE-2025-53521: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-03-27
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-15 · updated 2026-10-08
• Weakness: CWE-121

Description

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

• F5 BIG-IP APM: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 before 17.5.1.3 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3, 17.5.1.3

How to fix

Upgrade to a fixed version: F5 BIG-IP APM 15.1.10.8, 16.1.6.1, 17.1.3, 17.5.1.3. Check the vendor advisory for mitigations.

References

• https://my.f5.com/manage/s/article/K000156741
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521

Get alerted when CVE-2025-53521 or the next vulnerability affects your stack