Skip to content

KEV: F5 BIG-IP unspecified vulnerability (CVE-2025-53521)

Signal: Added to CISA KEV on 2026-03-27 (due 2026-03-30). F5 BIG-IP is exploitable in the wild.

What it is

F5 BIG-IP AMP contains an unspecified vulnerability that could allow remote code execution.

References: - CISA KEV entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - F5 guidance: https://my.f5.com/manage/s/article/K000156741 - F5 guidance: https://my.f5.com/manage/s/article/K000160486 - F5 guidance: https://my.f5.com/manage/s/article/K11438344 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-53521

Triage (15 minutes)

  1. Inventory all internet-facing F5 BIG-IP systems.
  2. Identify whether BIG-IP is used for:
  3. load balancing
  4. reverse proxying
  5. WAF / ADC / access gateway functions
  6. Check version, module exposure, and whether management interfaces are reachable from untrusted networks.
  7. Look for signs of compromise on all exposed devices before making changes.

Mitigation

  • Apply vendor mitigations immediately per F5 guidance.
  • If mitigations are unavailable, discontinue use of the affected product.
  • Restrict management access to trusted networks only.
  • Preserve configs and logs before patching if incident response is possible.

Hunt / detection

  • Review access logs for unusual requests to management or application interfaces.
  • Check for:
  • new admin users or sessions
  • unexpected config changes
  • outbound connections from the appliance
  • files or processes inconsistent with normal BIG-IP operation

Recovery notes

If compromise is suspected: - rotate credentials and certificates handled by the appliance - review downstream systems that trust the BIG-IP - rebuild or reimage affected devices from known-good sources - verify HA peers and failover state before returning traffic