A critical-severity vulnerability in F5's BIG-IP APM system, tracked as CVE-2025-53521, has been exploited by hackers to gain unauthorized access to networks. Cybersecurity firm F5 Networks recently updated the classification of this flaw from a denial-of-service vulnerability to one that allows remote code execution, indicating a significant escalation in risk.
F5 reported that the flaw can be exploited without user privileges on BIG-IP APM systems configured with specific access policies. As of March 2026, the company has observed active exploitation of the vulnerability, prompting the release of indicators of compromise for network defenders. F5 emphasized the importance of reviewing security protocols and conducting thorough checks on affected systems.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also taken action by adding this flaw to its list of actively exploited vulnerabilities. Federal agencies have been instructed to secure their systems by midnight on March 30. Meanwhile, the non-profit organization Shadowserver has identified over 240,000 BIG-IP instances exposed online, although it remains unclear how many are vulnerable or have been patched.