TLDR Tech / InfoSec
Over 14,000 F5 BIG-IP APM instances still exposed to RCE attacks
CVE-2025-53521, initially disclosed in October 2025 as a DoS bug in F5 BIG-IP APM, was later reclassified as a critical remote code execution (RCE) vulnerability actively being exploited after new details emerged in March. Attackers without authentication are targeting systems with access policies on virtual servers. Shadowserver reports over 17,100 internet-visible BIG-IP APM systems, with more than 14,000 still unpatched, despite CISA including the flaw in its Known Exploited Vulnerabilities (KEV) catalog and instructing federal agencies to fix the issue by Monday. F5 recommends that defenders review disk, logs, and terminal history for indicators of compromise, consider UCS backups from potentially affected systems as untrusted, and rebuild compromised systems from trusted, clean sources.
Read the full story