F5 reclassifies BIG-IP APM flaw CVE-2025-53521 as RCE after webshell attacks

In March 2026 F5 reclassified CVE-2025-53521, a BIG-IP Access Policy Manager (APM) bug first patched in October 2025 as a denial-of-service issue, as a critical unauthenticated remote code execution flaw, and confirmed attackers were exploiting it to plant webshells. If you patched in October, the original fix covers the RCE. If you didn't, every BIG-IP APM system with an access policy on a virtual server should be treated as possibly compromised.

What happened

F5 originally disclosed CVE-2025-53521 in October 2025 as a DoS flaw with a CVSS v4 score of 8.7. In late March 2026 it updated advisory K000156741, saying that "due to new information obtained in March 2026" the bug was being recategorised as RCE. The score rose to CVSS v4 9.3, and F5 confirmed the flaw "has been exploited in the vulnerable BIG-IP versions". F5 hasn't named the attackers.

CISA added the CVE to its Known Exploited Vulnerabilities catalog on 27 March 2026 and gave US federal civilian agencies until 30 March to secure affected systems. Shadowserver tracks more than 240,000 internet-exposed BIG-IP instances of all kinds. A few days later it reported more than 14,000 internet-exposed BIG-IP APM instances, without knowing how many have the vulnerable configuration.

F5 published indicators of compromise in a companion article, K000160486. They include:

• the files /run/bigtlog.pipe or /run/bigstart.ltm;
• hash, size or timestamp mismatches on /usr/bin/umount or /usr/sbin/httpd;
• audit log entries showing iControl REST API access from localhost, including attempts to disable SELinux;
• changes to the webtop files apm_css.php3, full_wt.php3 and webtop_popup_css.php3; and
• HTTP/S responses with status 201 and a CSS content type.

F5 warned that some webshells run only in memory and may leave no file changes.

Who is affected

• BIG-IP APM with an access policy configured on a virtual server, on versions 17.5.0–17.5.1 (fixed in 17.5.1.3), 17.1.0–17.1.2 (fixed in 17.1.3), 16.1.0–16.1.6 (fixed in 16.1.6.1) and 15.1.0–15.1.10 (fixed in 15.1.10.8).
• Systems updated to those fixed versions after October 2025 are protected against the RCE as well.
• Applications and APIs published through APM, since their traffic and user sessions pass through the compromised device.

What it means for developers and engineering teams

BIG-IP APM usually sits in front of internal applications, VPN access and APIs. It terminates TLS, authenticates users and forwards requests. Code execution on that box gives an attacker a privileged position: they can read decrypted traffic, capture credentials and session tokens as users sign in, and reach back-end networks that are otherwise unreachable from the internet.

The reclassification teaches a broader lesson. Severity labels can change. A "DoS-only" bug that was put off as low priority can turn out to be RCE once someone researches it further. Teams that patch edge appliances on the same schedule regardless of the label avoid that trap. In-memory webshells also mean "no suspicious files" doesn't prove a device is clean. F5's guidance is to rebuild compromised systems and restore configuration from a known-good source, because UCS backups taken after compromise may include the attacker's persistence.

What to do now

1. Check version and exposure: tmsh show sys version, then list virtual servers (tmsh list ltm virtual) and identify any with an APM access profile attached.
2. Upgrade to 17.5.1.3, 17.1.3, 16.1.6.1 or 15.1.10.8 or later.
3. Look for the IOCs: ls -la /run/bigtlog.pipe /run/bigstart.ltm, compare sha256sum /usr/bin/umount /usr/sbin/httpd against a known-good system on the same version, and review audit logs for localhost iControl REST activity.
4. If you find signs of compromise, rebuild from clean images and restore configuration from a backup taken before the compromise, not from recent UCS archives.
5. Rotate secrets that passed through or were stored on the device: admin passwords, TLS private keys, and the service accounts and back-end credentials it used.
6. Keep the management interface off the internet and restrict iControl REST to a management network.

Related on TechLogHub

• SSL/TLS: why TLS-terminating devices are high-value targets
• Authentication: access proxies and session handling

Sources

• F5 advisory K000156741: CVE-2025-53521
• BleepingComputer: Hackers now exploit critical F5 BIG-IP flaw in attacks, patch now
• BleepingComputer: Over 14,000 F5 BIG-IP APM instances still exposed to RCE attacks
• The Hacker News: CISA adds CVE-2025-53521 to KEV after active F5 BIG-IP APM exploitation
• CISA Known Exploited Vulnerabilities catalog