Critical F5 BIG-IP Flaw Upgraded to 9.8 RCE, Exploited in the Wild
F5 BIG-IP APM vulnerability CVE-2025-53521 upgraded to critical 9.8 RCE, actively exploited in the wild.
F5 BIG-IP APM vulnerability CVE-2025-53521 was reclassified from a minor denial-of-service flaw to a critical 9.8 remote code execution vulnerability affecting versions 15.x, 16.x, and 17.x. The vulnerability, a memory-handling error in the apmd process, is actively being exploited in the wild, with attackers using it to gain complete control of affected systems. F5 released indicators of compromise including malware hash c05d5254 and forensic indicators to help organizations identify compromised systems and recommends immediate patching or system rebuilds.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonA memory-handling vulnerability in F5 BIG-IP APM was severely underestimated, being initially classified as a minor DoS issue before being upgraded to a critical 9.8 RCE flaw. This miscategorization allowed the vulnerability to remain unpatched while attackers discovered and began actively exploiting it to gain complete system control. The incident demonstrates how improper vulnerability assessment can leave critical infrastructure exposed, especially when combined with delayed patching of internet-facing network appliances. Organizations with affected F5 systems now face potential complete compromise and may need to rebuild systems entirely.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2025-53521
- mitre_attack — T1190
- mitre_attack — T1078