CVE-2025-53521

No fix known ExploitedEPSS 2%CVSS 9.8

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Published 2025-10-15 · In CISA KEV since 2026-03-27 · CVE record · OSV

Products: F5 BIG-IP