NCSC Urges Immediate Action on Actively Exploited F5 BIG-IP APM Vulnerability
Summary
The NCSC warns that CVE-2025-53521, an actively exploited unauthenticated RCE vulnerability affecting BIG-IP APM, may compromise affected systems and urges organisations to isolate, investigate, and rebuild them as needed.
Key points
- CVE-2025-53521 affects BIG-IP APM when an access policy is configured on a virtual server; specific malicious traffic can enable remote code execution.
- F5 reports active exploitation of the vulnerability.
- All organisations using BIG-IP APM are considered affected.
- The NCSC recommends isolating affected systems where possible and replacing them with fully updated systems, noting this may cause service outages.
- Organisations should investigate for compromise even if systems have been updated, using F5's guidance and indicators of compromise.
- If investigation is not possible, the NCSC advises erasing or destroying the affected system and rebuilding it.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown
- Workarounds
- If possible, isolate affected systems and replace them with new, fully up-to-date systems.
- Investigate affected systems for compromise; if this is not possible, erase or destroy and rebuild the system.
CVE
Vendors
Products
BIG-IP APMremote code execution vulnerability affecting F5 BIG-IP Access Policy Manager (CVE-2025-53521). F5 BIG-IP APM is a common component, especially within large enterprises.F5 BIG-IP Access Policy ManagerOrganisations have been encouraged to take action against a vulnerability affecting F5 BIG-IP Access Policy Manager.