CVE-2025-53521
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
Description
CVE-2025-53521 is a CRITICAL stack-based buffer overflow vulnerability in F5 BIG-IP Access Policy Manager (APM), carrying a CVSS v4 score of 9.3. The vulnerability enables remote code execution when an APM access policy is configured on a virtual server, allowing malicious network traffic to trigger the buffer overflow and execute arbitrary code. Initially classified as a denial of service issue when disclosed in October 2025, the vulnerability was reclassified as enabling remote code execution after exploitation evidence emerged. Affected versions include BIG-IP 15.x (prior to 15.1.10.8), 16.x (prior to 16.1.6.1), 17.1.x (prior to 17.1.3), and 17.5.x (prior to 17.5.1.3). F5 released initial patches in October 2025 and additional patches in February 2026. Three public proof-of-concept exploits are available on GitHub. CISA added CVE-2025-53521 to the KEV catalog on March 27, 2026, with an unusually tight remediation deadline of March 30, 2026. The EPSS score of 0.414 (41.4%) indicates high exploitation activity, placing this vulnerability among the most actively exploited in the current threat landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| f5 | big-ip access policy manager | >= 15.1.0, < 15.1.10.8; >= 16.1.0, < 16.1.6.1; >= 17.1.0, < 17.1.3; >= 17.5.0, < 17.5.1.3 |
References
- https://my.f5.com/manage/s/article/K000156741(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521(US Government Resource)
Weakness Type
Stack-Based Buffer Overflow
A stack-based buffer overflow occurs when a program writes data beyond the bounds of a buffer allocated on the stack, overwriting adjacent memory including return addresses, saved frame pointers, and local variables. In contrast to heap-based overflows, stack-based overflows often provide more reliable exploitation paths because the memory layout is predictable. By overwriting the return address on the stack, an attacker can redirect execution to attacker-controlled code, achieving arbitrary code execution with the privileges of the vulnerable process.
In CVE-2025-53521, the buffer overflow exists in the BIG-IP APM processing path that handles network traffic for virtual servers with access policies configured. When malicious traffic is sent to an APM-enabled virtual server, the incoming data exceeds the bounds of a stack-allocated buffer during processing, corrupting adjacent stack memory. Because BIG-IP APM processes typically run with elevated privileges to manage network traffic and authentication decisions, successful exploitation grants the attacker code execution with high-privilege access to the BIG-IP appliance — a network device that often sits at the boundary between untrusted and trusted network segments.
Impact Analysis
CVE-2025-53521 carries a CVSS v4 score of 9.3 (CRITICAL), reflecting the severe consequences of remote code execution on a network boundary device.
Confidentiality (High): Successful exploitation provides full access to the BIG-IP appliance, which processes and inspects all traffic passing through its virtual servers. This includes authentication credentials, session tokens, API keys, and application data. BIG-IP APM specifically handles access control and authentication, meaning it may store or process LDAP/Active Directory credentials, SAML tokens, client certificates, and multi-factor authentication data. The attacker gains the ability to passively intercept all traffic passing through the compromised appliance.
Integrity (High): Code execution on the BIG-IP appliance allows modification of traffic management rules, access policies, SSL/TLS configurations, and iRules. An attacker can inject malicious content into passing traffic, redirect authentication flows, modify application responses, install persistent backdoors, and alter logging configurations to cover their tracks. The trust position of BIG-IP within network architecture makes integrity compromise particularly dangerous.
Availability (High): The vulnerability was initially classified as a denial of service issue, confirming that exploitation can crash the affected process or appliance. Beyond DoS, the remote code execution capability allows the attacker to disrupt all services relying on the BIG-IP appliance, affecting potentially hundreds of backend applications and thousands of users.
Exploitation Context: With an EPSS score of 0.414 (41.4%) and three public proof-of-concept exploits on GitHub, this vulnerability is under broad active exploitation. The three-day KEV remediation deadline (March 27 to March 30, 2026) and the reclassification from DoS to RCE underscore the escalating severity. BIG-IP appliances are high-value targets due to their position in network architecture and their role in authentication and access control.
Exploit Maturity
Active Exploitation with Public Exploits: CVE-2025-53521 is under widespread active exploitation in the wild. CISA added it to the KEV catalog on March 27, 2026, with a three-day remediation deadline of March 30, 2026 — one of the shortest deadlines issued, reflecting extreme urgency.
Public Proof-of-Concept Availability: Three proof-of-concept exploits are publicly available on GitHub, significantly lowering the barrier to exploitation. The availability of working PoCs means any attacker with network access to an APM-enabled virtual server can attempt exploitation without developing their own exploit.
Severity Reclassification: The vulnerability was initially disclosed in October 2025 as a denial of service issue. After evidence of exploitation demonstrated remote code execution capability, the vulnerability was reclassified with a significantly higher severity rating. This reclassification timeline means that organizations relying on the initial DoS assessment may have underestimated the urgency of patching.
EPSS Context: The EPSS score of 0.414 (41.4%) is exceptionally high, placing this vulnerability in the top tier of exploitation likelihood. This score reflects confirmed mass exploitation activity, amplified by the availability of public exploits and the high value of BIG-IP appliances as targets.
Ransomware Association: BIG-IP appliances have historically been targeted by ransomware operators and initial access brokers who exploit them to gain network foothold access. Organizations should check the CISA KEV entry for specific ransomware campaign associations. The RCE capability and network boundary position make this an ideal initial access vector for ransomware deployment.
Patch Timeline: F5 released initial patches in October 2025 and additional patches in February 2026. Organizations that applied only the October 2025 patches should verify they have also applied the February 2026 updates, as the RCE exploitation path may not have been fully addressed in the initial fix.
Remediation
-
Apply F5 patches immediately. Update all affected BIG-IP systems to patched versions: 15.1.10.8 or later for the 15.x branch, 16.1.6.1 or later for the 16.x branch, 17.1.3 or later for the 17.1.x branch, and 17.5.1.3 or later for the 17.5.x branch. Prioritize systems with APM access policies configured on virtual servers, as these are directly exploitable. Consult F5's security advisory (K-article) for specific upgrade paths and instructions.
-
Identify all BIG-IP systems with APM access policies. The vulnerability is exploitable only when an APM access policy is configured on a virtual server. Audit all BIG-IP systems to identify which have APM modules enabled and active access policies. These systems require immediate patching. Systems without APM or without active access policies on virtual servers have reduced risk.
-
Restrict network access to BIG-IP management and virtual server ports. Limit access to BIG-IP management interfaces (typically TCP 443 for the web UI and TCP 22 for SSH) to trusted management networks only. For APM-enabled virtual servers, implement network-level filtering to restrict access to known legitimate client IP ranges where feasible.
-
Scan for indicators of compromise. Given the widespread exploitation and public exploit availability, assume that any unpatched BIG-IP system with internet-facing APM virtual servers may be compromised. Check for unauthorized configuration changes, unexpected iRules, modified access policies, unknown user accounts, unusual outbound network connections, and files in temporary directories. Review system logs for exploitation patterns and anomalous traffic.
-
Rotate credentials processed by the BIG-IP APM. If compromise is suspected or cannot be ruled out, rotate all credentials that the BIG-IP APM processes or stores, including LDAP/AD service account credentials, SAML signing certificates, client SSL certificates, and any credentials cached in APM sessions. Change administrative passwords on the BIG-IP appliance itself.
-
Implement monitoring and detection rules. Deploy IDS/IPS signatures for the public PoC exploits targeting CVE-2025-53521. Monitor BIG-IP system logs for crash events (which may indicate exploitation attempts), unexpected process restarts, and anomalous authentication or traffic patterns. Forward BIG-IP logs to a centralized SIEM for correlation and alerting.
Technical Details
CVE-2025-53521 is a stack-based buffer overflow in F5 BIG-IP Access Policy Manager that enables remote code execution through malicious network traffic.
CVSS v4 Vector Analysis: The CVSS v4 score of 9.3 (CRITICAL) reflects Attack Vector (Network), Attack Complexity (Low), Privileges Required (None), User Interaction (None), and High impact across Confidentiality, Integrity, and Availability. The vulnerability is exploitable by unauthenticated remote attackers who can send traffic to an APM-enabled virtual server.
Vulnerability Mechanism: The buffer overflow occurs in the BIG-IP APM traffic processing path. When an APM access policy is configured on a virtual server, incoming traffic is processed through the APM module for authentication and access control decisions. During this processing, a stack-allocated buffer is used to handle certain input data. Maliciously crafted traffic can cause data to be written beyond the buffer boundary, overwriting the return address and other stack frame data. This enables the attacker to redirect program execution to attacker-controlled code.
Exploitation Prerequisites: The attack requires only network access to a virtual server with an APM access policy configured. No authentication, valid session, or user interaction is needed. The attack can be executed with a single malicious request, making it suitable for automated scanning and exploitation.
Severity Reclassification History: F5 initially disclosed this vulnerability in October 2025, classifying it as a denial of service condition where the buffer overflow caused a crash. Subsequent analysis and exploitation evidence revealed that the overflow provides sufficient control over the stack to achieve reliable arbitrary code execution, not just a crash. This reclassification from DoS to RCE significantly elevated the vulnerability's risk assessment.
Patch History: F5 released patches in October 2025 addressing the initial DoS disclosure, and additional patches in February 2026 addressing the full RCE exploitation path. The dual patch cycle means organizations should verify they have applied the most recent patches (February 2026 or later), not just the October 2025 fixes.
Affected Version Matrix:
- BIG-IP 15.x: Vulnerable below 15.1.10.8
- BIG-IP 16.x: Vulnerable below 16.1.6.1
- BIG-IP 17.1.x: Vulnerable below 17.1.3
- BIG-IP 17.5.x: Vulnerable below 17.5.1.3
Public Exploit Availability: Three proof-of-concept exploits are available on GitHub, providing working exploitation code that demonstrates the full attack chain from buffer overflow to code execution. The public availability of these exploits has dramatically lowered the skill barrier for exploitation.
Frequently Asked Questions
What is CVE-2025-53521?
CVE-2025-53521 is a critical stack-based buffer overflow in F5 BIG-IP Access Policy Manager (APM) that enables unauthenticated remote code execution. When an APM access policy is configured on a virtual server, an attacker can send malicious traffic to trigger the buffer overflow and execute arbitrary code on the BIG-IP appliance. It was added to CISA's KEV catalog with a three-day remediation deadline.
Is my BIG-IP system affected if I don't use APM?
The vulnerability is exploitable only when an APM access policy is configured on a virtual server. If you do not use the BIG-IP APM module or do not have active access policies on your virtual servers, you are at reduced risk. However, F5 recommends applying the patches regardless, as the affected code may be present even if APM is not actively configured.
Why was this reclassified from DoS to RCE?
When initially disclosed in October 2025, the vulnerability was classified as denial of service because the buffer overflow appeared to only cause a crash. Subsequent analysis and real-world exploitation demonstrated that attackers can reliably control the overflow to achieve arbitrary code execution, not just a crash. This reclassification significantly increased the severity rating.
Are there public exploits available?
Yes, three proof-of-concept exploits are publicly available on GitHub. This dramatically lowers the barrier to exploitation and means any attacker with network access to an APM-enabled virtual server can attempt exploitation. Immediate patching is essential.
Which BIG-IP versions should I update to?
Update to the following minimum versions: BIG-IP 15.1.10.8 for the 15.x branch, 16.1.6.1 for the 16.x branch, 17.1.3 for the 17.1.x branch, and 17.5.1.3 for the 17.5.x branch. Ensure you apply the February 2026 patches, as the October 2025 patches may not fully address the RCE exploitation path.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.