critical9.8Known exploited
CVE-2025-53521
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-03-27. Federal due date: 2026-03-30.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| F5 | Big-Ip Access Policy Manager | from 15.1.0 before 15.1.10.8 from 16.1.0 before 16.1.6.1 from 17.1.0 before 17.1.3 from 17.5.0 before 17.5.1.3 |