{"id":419,"date":"2026-03-28T07:43:15","date_gmt":"2026-03-28T07:43:15","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=419"},"modified":"2026-03-28T07:43:15","modified_gmt":"2026-03-28T07:43:15","slug":"cisa-adds-cve-2025-53521-to-kev-after-active-f5-big-ip-apm-exploitation","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=419","title":{"rendered":"CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Mar 28, 2026<\/span><\/span>Vulnerability \/ Network Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added<\/a> a critical security flaw impacting F5 BIG-IP Access Policy Manager (APM) to its Known Exploited Vulnerabilities (KEV<\/a>) catalog, citing evidence of active exploitation.<\/p>\n

The vulnerability in question is CVE-2025-53521<\/strong> (CVSS v4 score: 9.3), which could allow a threat actor to achieve remote code execution.<\/p>\n

\u00abWhen a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE),\u00bb according to a description of the flaw in CVE.org.<\/p>\n

While the shortcoming was initially categorized and remediated as a denial-of-service (DoS) vulnerability with a CVSS v4 score of 8.7, F5 said it has been reclassified as a case of RCE in light of \u00abnew information obtained in March 2026.\u00bb<\/p>\n

The company has since updated<\/a> its advisory to confirm that the vulnerability \u00abhas been exploited in the vulnerable BIG-IP versions.\u00bb It did not share any additional details on who may be behind the exploitation activity.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

However, F5 shared a number of indicators<\/a> that can be used to assess if the system has been compromised –<\/p>\n