Back Securityaffairs.Co

U.S. CISA adds a flaw in F5 BIG

Securityaffairs.Co •Pierluigi Paganini • March 28, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in F5 BIG-IP AMP to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in F5 BIG-IP AMP, tracked as CVE-2025-53521 (CVSS ver. 3.1 score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability in BIG-IP APM allows […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Exploitation of RCE Vulnerability in F5 BIG-IP APM Systems A critical unauthenticated remote code execution vulnerability, tracked as CVE-2025-53521, in F5's BIG-IP Access Policy Manager (APM) systems is currently being exploited. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog on March 27, 2026, following an update from F5 regarding a data breach attributed to a sophisticated nation-state threat actor. The vulnerability has a CVSS score of 9.8, indicating its high severity. Organizations using F5 BIG-IP APM systems are at risk, as the flaw allows attackers to execute arbitrary code without authentication. F5 initially published a security advisory on October 15, 2025, when the breach was confirmed. The ongoing exploitation poses a significant threat to affected systems and their users. 23 sources 76

Extracted Entities

CVEs (1)

CVE-2025-53521

Platforms (2)

Big-ip APM F5 Big-ip AMP