NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

F5 BIG-IP APM code-execution flaw CVE-2025-53521 exploited to plant backdoors

Attackers exploited CVE-2025-53521 in F5 BIG-IP APM, used for organisational access and remote working. Fixes are available for all four listed branches. Ask IT to update and investigate earlier compromise: an upgrade alone may leave a backdoor.

What to do

If your business or family office uses BIG-IP APM, ask its IT provider to install a current supported release containing the fix: at least 17.5.1.3, 17.1.3, 16.1.6.1 or 15.1.10.8 in the corresponding branch. Ask them to follow F5's compromise-assessment guidance as well, including for appliances already updated. There is no update to install on your personal phone or computer for this flaw.

What’s happening

CVE-2025-53521 is a stack-based buffer overflow in F5 BIG-IP Access Policy Manager, which organisations use to control access to networks and applications. An attacker needs no login to run code when an APM access policy is configured on a virtual server. F5 first disclosed it in October 2025 as a service-disruption flaw, then reclassified it after new information in March 2026. CISA listed it as exploited on 27 March. F5 confirmed that the original fixes also block code execution; all four listed release branches have fixes. However, updating does not establish that a previously compromised appliance is clean. September research described associated malware that hides backdoors in memory and can persist through upgrade images. The reviewed sources do not establish when attacks began, a victim count or an end to the campaign. F5 did not evaluate versions beyond technical support.

What
Flaw
Affects
F5 BIG-IP Access Policy Manager (APM)
Affected
BIG-IP APM 17.5.0 to before 17.5.1.3
BIG-IP APM 17.1.0 to before 17.1.3
BIG-IP APM 16.1.0 to before 16.1.6.1
BIG-IP APM 15.1.0 to before 15.1.10.8
Exploitation requires an APM access policy configured on a virtual server; versions beyond End of Technical Support were not evaluated.
Fixed in
BIG-IP 17.5.1.3
BIG-IP 17.1.3
BIG-IP 16.1.6.1
BIG-IP 15.1.10.8
CVE
CVE-2025-53521
Since
27 Mar 2026
Closed
7 Sept 2026

Timeline

  1. Update

    Sophos published analysis of malware associated with the affected BIG-IP APM environments. It described backdoors hidden in memory and a related installer capable of carrying the infection into upgrade images, reinforcing the need to investigate earlier compromise.

  2. Vendor revisedFixed

    F5's advisory update confirmed that the flaw allows attackers to run code and had been exploited on vulnerable systems. F5 said it had validated that the original fixes also prevent code execution.

  3. CISA added

    CISA added CVE-2025-53521 to its Known Exploited Vulnerabilities catalogue. Canada's Cyber Centre also reported F5's confirmation that attackers had exploited it.

  4. Made public

    F5 disclosed CVE-2025-53521 in BIG-IP Access Policy Manager. It was initially described and remediated as a flaw that could interrupt service.

Sources

  1. F5's published CVE record: CVE-2025-53521F5 · 31 Mar 2026
  2. F5 security advisory (AV25-669) – Update 1Canadian Centre for Cyber Security · 27 Mar 2026
  3. CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM ExploitationThe Hacker News · 28 Mar 2026
  4. Hackers exploiting critical F5 BIG-IP flaw in attacks, patch nowBleepingComputer · 30 Mar 2026
  5. Dissecting a PHP web server rootkitSophos · 7 Sept 2026
  6. The Files Look Clean. The F5 Appliance Could Still Be Backdoored.BlackTree · 10 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from March 2026 · JSON · RSS