Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-53521

CVE-2025-53521CRITICAL

F5 BIG-IP — BigIP APM Vulnerability

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0230   82.7   YES

AFFECTED
  Product  Versions  Fixed
  BIG-IP   17.5.0 –  —

TIMELINE
  Oct 3   Reserved by f5
  Oct 15  Published (CNA: f5)
  Mar 27  Added to CISA KEV, remediation due 2026-03-30

CWE-121 · CNA: f5 · CVSS v4.0 · 2 references · KEV due March 30, 2026

Description

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
October 3, 2025	Reserved	Reserved by f5
October 15, 2025	Published	Published (CNA: f5)
March 27, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-03-30

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
F5	BIG-IP	—	17.5.0	—

Weaknesses

CWE-121

References (2)

https://my.f5.com/manage/s/article/K000156741 [vendor-advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521 [government-resource]

Authoritative record: CVE-2025-53521 at cve.org

Vendors: f5

Weaknesses: CWE-121

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-53521 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, October 7, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.