{"id":"f5-big-ip-apm-attacks-mar-2026","category":"patch","status":"closed","title":"F5 BIG-IP APM code-execution flaw CVE-2025-53521 exploited to plant backdoors","tldr":"Attackers exploited CVE-2025-53521 in F5 BIG-IP APM, used for organisational access and remote working. Fixes are available for all four listed branches. Ask IT to update and investigate earlier compromise: an upgrade alone may leave a backdoor.","summary":"CVE-2025-53521 is a stack-based buffer overflow in F5 BIG-IP Access Policy Manager, which organisations use to control access to networks and applications. An attacker needs no login to run code when an APM access policy is configured on a virtual server. F5 first disclosed it in October 2025 as a service-disruption flaw, then reclassified it after new information in March 2026. CISA listed it as exploited on 27 March. F5 confirmed that the original fixes also block code execution; all four listed release branches have fixes. However, updating does not establish that a previously compromised appliance is clean. September research described associated malware that hides backdoors in memory and can persist through upgrade images. The reviewed sources do not establish when attacks began, a victim count or an end to the campaign. F5 did not evaluate versions beyond technical support.","action":"If your business or family office uses BIG-IP APM, ask its IT provider to install a current supported release containing the fix: at least 17.5.1.3, 17.1.3, 16.1.6.1 or 15.1.10.8 in the corresponding branch. Ask them to follow F5's compromise-assessment guidance as well, including for appliances already updated. There is no update to install on your personal phone or computer for this flaw.","product":"F5 BIG-IP Access Policy Manager (APM)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2025-53521"],"tags":["f5","big-ip","apm","remote-code-execution","actively-exploited","backdoor"],"affected":["BIG-IP APM 17.5.0 to before 17.5.1.3","BIG-IP APM 17.1.0 to before 17.1.3","BIG-IP APM 16.1.0 to before 16.1.6.1","BIG-IP APM 15.1.0 to before 15.1.10.8","Exploitation requires an APM access policy configured on a virtual server; versions beyond End of Technical Support were not evaluated."],"fixed":["BIG-IP 17.5.1.3","BIG-IP 17.1.3","BIG-IP 16.1.6.1","BIG-IP 15.1.10.8"],"matches":[],"sources":[{"kind":"advisory","title":"F5's published CVE record: CVE-2025-53521","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/53xxx/CVE-2025-53521.json","by":"F5","date":"2026-03-31"},{"kind":"advisory","title":"F5 security advisory (AV25-669) – Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/f5-security-advisory-av25-669","by":"Canadian Centre for Cyber Security","date":"2026-03-27"},{"kind":"news","title":"CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation","url":"https://thehackernews.com/2026/03/cisa-adds-cve-2025-53521-to-kev-after.html","by":"The Hacker News","date":"2026-03-28"},{"kind":"news","title":"Hackers exploiting critical F5 BIG-IP flaw in attacks, patch now","url":"https://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-f5-big-ip-flaw-in-attacks-patch-now/amp/","by":"BleepingComputer","date":"2026-03-30"},{"kind":"research","title":"Dissecting a PHP web server rootkit","url":"https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit","by":"Sophos","date":"2026-09-07"},{"kind":"news","title":"The Files Look Clean. The F5 Appliance Could Still Be Backdoored.","url":"https://blacktree.nl/2026/09/10/f5-big-ip-apm-memory-web-shell/","by":"BlackTree","date":"2026-09-10"}],"started":"2026-03-27","closed":"2026-09-07","created":"2026-11-03T22:22:50.073Z","updated":"2026-11-03T22:22:50.073Z","cve_notes":[{"cve":"CVE-2025-53521","name":"Stack-based buffer overflow in F5 BIG-IP APM","what":"A stack-based buffer overflow in BIG-IP Access Policy Manager lets an attacker without a login run code through malicious network traffic when an APM access policy is configured on a virtual server.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-09-07","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Sophos published analysis of malware associated with the affected BIG-IP APM environments. It described backdoors hidden in memory and a related installer capable of carrying the infection into upgrade images, reinforcing the need to investigate earlier compromise.","url":"https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit","by":"Sophos","patch":null},{"at":"2026-03-29","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"F5's advisory update confirmed that the flaw allows attackers to run code and had been exploited on vulnerable systems. F5 said it had validated that the original fixes also prevent code execution.","url":"https://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-f5-big-ip-flaw-in-attacks-patch-now/amp/","by":"BleepingComputer","patch":"patched"},{"at":"2026-03-27","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2025-53521 to its Known Exploited Vulnerabilities catalogue. Canada's Cyber Centre also reported F5's confirmation that attackers had exploited it.","url":"https://www.cyber.gc.ca/en/alerts-advisories/f5-security-advisory-av25-669","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2025-10-15","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"F5 disclosed CVE-2025-53521 in BIG-IP Access Policy Manager. It was initially described and remediated as a flaw that could interrupt service.","url":"https://thehackernews.com/2026/03/cisa-adds-cve-2025-53521-to-kev-after.html","by":"The Hacker News","patch":null}],"url":"https://hard.fyi/live/f5-big-ip-apm-attacks-mar-2026/","json":"https://hard.fyi/api/live?id=f5-big-ip-apm-attacks-mar-2026"}