Hackers Now Exploit Critical F5 BIG-IP Flaw in Attacks — Patch Now

F5 Reclassifies BIG-IP APM Flaw as Critical RCE — Active Exploitation Confirmed

F5 has issued an urgent security advisory reclassifying CVE-2025-53521, originally disclosed as a denial-of-service (DoS) vulnerability in BIG-IP Access Policy Manager (APM), as a critical remote code execution (RCE) flaw. The company confirmed that threat actors are actively exploiting the vulnerability in the wild, deploying webshells on unpatched BIG-IP devices to gain persistent access. The reclassification carries a maximum or near-maximum CVSS score, placing it among the most severe vulnerabilities in enterprise network infrastructure in 2026.

From DoS to RCE: What Changed

The reclassification from DoS to RCE is a significant escalation. DoS vulnerabilities allow attackers to crash or destabilize a service — disruptive but typically not resulting in persistent access. RCE vulnerabilities allow attackers to execute arbitrary code on the affected device, often leading to full system compromise.

F5's updated advisory indicates that the original DoS characterization understated the exploitability and impact of the vulnerability. Further analysis — likely prompted by observed exploitation activity — revealed that the flaw could be chained or exploited directly to achieve code execution, not merely cause service disruption.

The distinction matters operationally: organizations that deprioritized patching based on the original DoS classification should treat this as an emergency remediation.

Webshell Deployment: Persistent Access at Scale

Confirmed exploitation reports indicate that attackers are deploying webshells on unpatched BIG-IP appliances following successful exploitation. A webshell is a malicious script placed on a compromised web-accessible server that provides the attacker with persistent remote access, command execution, and often file upload and download capabilities.

Webshells are particularly dangerous on network appliances like BIG-IP because:

• BIG-IP devices sit at the network perimeter — a compromised appliance gives attackers a privileged vantage point for lateral movement
• Webshells survive reboots if placed in persistent storage paths
• Detection is difficult — appliance webshells may not be covered by traditional endpoint security tools
• BIG-IP handles authentication flows via APM — compromised devices can intercept, modify, or bypass authentication for all traffic they proxy

Why BIG-IP APM Is a High-Value Target

F5 BIG-IP is deployed by thousands of large enterprises, financial institutions, government agencies, and critical infrastructure operators worldwide. The Access Policy Manager (APM) module specifically handles:

• VPN and remote access authentication
• Zero trust network access (ZTNA) policies
• Identity and MFA enforcement
• Application access control

Compromising BIG-IP APM gives attackers visibility into and control over the authentication layer of the target organization's entire application estate. Credentials, session tokens, and authentication decisions pass through APM — making it an intelligence goldmine and an ideal pivot point for attackers seeking to move deeper into enterprise networks.

Historical Context: BIG-IP in the Threat Landscape

CVE-2025-53521 is not the first BIG-IP vulnerability to be actively exploited. F5 BIG-IP has been a persistent target:

• CVE-2020-5902 — Critical RCE in TMUI (Traffic Management User Interface), widely exploited
• CVE-2022-1388 — Authentication bypass allowing unauthenticated RCE, exploited within hours of disclosure
• CVE-2023-46747 — Another APM authentication bypass used in nation-state campaigns

The pattern is clear: when F5 BIG-IP vulnerabilities are disclosed, sophisticated threat actors move quickly to exploit them before patches are applied. The reclassification of CVE-2025-53521 to RCE with confirmed active exploitation follows this established playbook.

Immediate Response Steps

1. Identify Exposed Instances

Determine which BIG-IP APM instances in your environment are running the vulnerable version and are network-accessible.

# On BIG-IP device — check version
tmsh show sys version
 
# List APM provisioned modules
tmsh list sys provision apm

2. Apply F5 Security Patch

Apply the F5-issued security patch as the primary remediation. Check F5's official security advisory portal for the applicable hotfix for your BIG-IP version.

# Download and stage the patch (replace with actual hotfix filename from F5)
# scp hotfix-BIG-IP-*.iso admin@bigip:/shared/images/
 
# Install via TMSH
tmsh install sys software hotfix /shared/images/Hotfix-BIG-IP-<version>.iso
 
# Verify installation
tmsh show sys version

3. Scan for Webshell Indicators

# Search for recently modified files in web-accessible paths on BIG-IP
find /var/apm/htmldocs -name "*.php" -newer /tmp/check_date -type f
find /usr/local/www -name "*.php" -newer /tmp/check_date -type f
 
# Check for unusual Perl/Python/shell scripts in web directories
find /var/apm -name "*.pl" -o -name "*.py" -o -name "*.sh" | xargs ls -la
 
# Review access logs for unusual POST requests to unexpected paths
grep -i "POST" /var/log/httpd/httpd_access_log | grep -v "known-paths"

4. Temporary Mitigations

If immediate patching is not possible:

• Restrict BIG-IP management and APM interfaces to trusted IP ranges via ACLs
• Enable enhanced logging on APM and TMUI interfaces
• Implement IDS/IPS signatures for CVE-2025-53521 exploit patterns
• Monitor for unusual outbound connections from BIG-IP appliances

Detection and Monitoring

After patching, establish ongoing monitoring for signs of prior exploitation:

• Review /var/log/httpd/ access logs for unusual request patterns preceding patch application
• Check for new or modified files in APM web directories with timestamps before patching
• Audit APM policy changes and administrator account activity
• Correlate BIG-IP logs with SIEM for post-exploitation indicators (unusual outbound, new admin accounts)
• Review SSL/TLS inspection logs for anomalous decrypted traffic if applicable

Key Takeaways

1. F5 reclassified CVE-2025-53521 from DoS to critical RCE after confirming active exploitation — prioritize this vulnerability immediately.
2. Attackers are deploying webshells on unpatched BIG-IP APM devices, establishing persistent backdoors on high-value perimeter appliances.
3. BIG-IP APM handles authentication and access control for enterprise applications — compromise enables credential harvesting and lateral movement at scale.
4. The reclassification window creates risk for organizations that deprioritized patching based on the original DoS rating — treat this as an emergency.
5. Apply the F5 security patch as the primary remediation; scan for webshell indicators in web-accessible directories on all affected appliances.

Sources

• Hackers Now Exploit Critical F5 BIG-IP Flaw in Attacks, Patch Now — BleepingComputer
• F5 Security Advisories Portal
• CISA Known Exploited Vulnerabilities Catalog