F5 BIG-IP APM Critical Stack Overflow CVE-2025-53521 Exploited, 14K Instances Exposed
Summary
CISA added a critical stack-based buffer overflow vulnerability (CVE-2025-53521) in F5 BIG-IP Access Policy Manager (APM) to its KEV catalog due to active exploitation. The flaw could allow remote code execution, and over 14,000 BIG-IP APM instances remain exposed online. Organizations must apply patches immediately.
Threat Analysis
CVE-2025-53521 is a critical stack-based buffer overflow vulnerability in F5 BIG-IP Access Policy Manager (APM), a widely deployed enterprise network access control solution. The vulnerability could allow remote code execution by unauthenticated attackers. CISA added CVE-2025-53521 to its Known Exploited Vulnerabilities catalog due to confirmed active exploitation in the wild. Security researchers have identified over 14,000 BIG-IP APM instances that remain exposed and unpatched online, representing a significant attack surface. F5 BIG-IP is commonly used in enterprise and government environments to manage application delivery and secure remote access, making successful exploitation particularly impactful. Organizations should immediately apply F5's security patches, restrict management interface access to trusted networks, implement network segmentation, and monitor for unusual authentication attempts or traffic patterns on BIG-IP systems.