Big Ip Advanced Web Application Firewall
CVE-2025-53521
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Critical risk (CVSS 9.3). BIG-IP appliances are deployed at the network perimeter of enterprise and service provider networks. RCE on the appliance provides access to all traffic flowing through the device and a pivot point into internal networks. |
| Exploit ScenarioDerived | An attacker sends crafted traffic to a BIG-IP virtual server with APM configured. The malicious traffic triggers the vulnerability, achieving code execution on the BIG-IP appliance. The attacker can then intercept credentials, modify traffic, and access internal backend servers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
F5 BIG-IP APM (Access Policy Manager) contains a remote code execution vulnerability triggered by specific malicious traffic when an access policy is configured on a virtual server.
Earlier versions of this analysis (1)
A critical RCE vulnerability in BIG-IP APM allows remote code execution when an access policy is configured on a virtual server and specific malicious traffic is sent to the device.
RemediationAI
Apply F5 security updates. Remove APM configurations from internet-facing virtual servers if not required. Restrict management access to BIG-IP.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-770 allocation of resources without limits vulnerability in BIG-IP APM's access policy processing can be exploited through crafted traffic to achieve remote code execution on the BIG-IP device.
Know when Big Ip Advanced Web Application Firewall gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
Lifecycle Timeline
4DescriptionCVE.org
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Executive ViewAI
F5 BIG-IP Access Policy Manager contains a critical unauthenticated remote code execution vulnerability (CVE-2025-53521, CVSS 9.3) affecting organizations using APM access policies on virtual servers. While no active exploitation has been confirmed, the vulnerability requires immediate inventory and mitigation action given the potential for complete system compromise across multiple F5 product lines. Organizations cannot currently patch and must implement compensating controls immediately to reduce attack surface.
Until vendor patch becomes available: (1) Restrict network access to BIG-IP APM virtual servers using firewall rules and network segmentation to trusted administrative IP ranges only; (2) Disable APM access policies on virtual servers not operationally required; (3) Implement enhanced authentication and monitoring on administrative access to BIG-IP management interfaces; (4) Deploy WAF or network-based intrusion detection rules targeting anomalous traffic patterns to APM endpoints; (5) Maintain offline backups and recovery procedures to minimize impact if compromise occurs.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
F5 BIG-IP contains an authenticated command injection in the iControl REST API and TMOS Shell (tmsh) save command. Authe
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BI
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated
BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdow
A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x
On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclose
Exploit-DB