Over 14,000 F5 BIG-IP APM Instances Still Exposed to RCE Attacks

Despite active exploitation and a CISA KEV listing, more than 14,000 F5 BIG-IP APM instances remain exposed to a critical remote code execution vulnerability, according to data from internet security watchdog Shadowserver. The unpatched systems are accessible directly from the internet, leaving them wide open to ongoing attacks.

Background

The vulnerability — tracked as CVE-2025-53521 — affects F5's BIG-IP Access Policy Manager (APM), a widely deployed enterprise application delivery and access management platform. The flaw was initially classified as a serious security issue before being reclassified as a full remote code execution (RCE) vulnerability following deeper analysis and confirmed real-world exploitation.

CISA added CVE-2025-53521 to its Known Exploited Vulnerabilities (KEV) catalog, issuing a mandate for federal agencies to apply patches by a binding operational directive deadline. Despite this, the Shadowserver scan reveals tens of thousands of systems in the private sector remain unpatched and internet-exposed.

What Is BIG-IP APM?

F5 BIG-IP APM is an enterprise-grade access and identity management platform used by organizations globally to control and secure access to applications, APIs, and internal resources. It handles SSL termination, VPN access, multi-factor authentication, and application-layer firewalling. Its privileged network position — sitting between users and internal applications — makes a successful RCE exploit against it exceptionally dangerous.

A compromised BIG-IP APM appliance can enable an attacker to:

• Intercept and modify all traffic passing through the device
• Capture authentication credentials and session tokens from thousands of users
• Pivot laterally into internal networks behind the ADC
• Disable security policies and bypass authentication controls
• Establish persistent reverse shells into the corporate network

Exploitation Activity

Security researchers and threat intelligence teams have confirmed active exploitation of CVE-2025-53521 in the wild. Attack patterns observed include:

1. Reconnaissance: Attackers scan for BIG-IP APM management interfaces
   exposed on standard ports (443, 8443)

2. Exploitation: Malicious HTTP requests trigger the RCE flaw in the
   APM policy engine

3. Post-exploitation: Deployment of web shells, credential harvesting
   tools, and network reconnaissance utilities

4. Lateral movement: Attackers use harvested VPN credentials and
   session tokens to access internal resources

Threat actors ranging from opportunistic ransomware groups to nation-state-affiliated APTs have been observed targeting unpatched F5 infrastructure in previous exploit waves. Given the CISA KEV listing and the scale of exposed instances, a significant escalation in attack volume is expected.

Scale of Exposure

Shadowserver's internet-wide scanning identified more than 14,000 BIG-IP APM instances with their management interfaces or vulnerable endpoints exposed to the public internet. The exposed systems are distributed globally, with concentrations in:

• North America — particularly the United States, where federal and enterprise deployments are dense
• Europe — financial services and telecom sectors
• Asia-Pacific — government and critical infrastructure operators

The 14,000 figure represents instances with confirmed version fingerprints indicating they are running unpatched software. The actual number of vulnerable deployments is likely higher, as many organizations use configurations that obscure version information from external scanners.

F5's Patch Availability

F5 has released patches addressing CVE-2025-53521 and has published a security advisory with detailed remediation guidance. Administrators running affected versions should:

1. Identify affected systems — check BIG-IP APM version against F5's advisory
2. Apply the patch immediately — follow F5's upgrade procedures for the specific version track
3. Restrict management interface access — ensure the BIG-IP management port is not accessible from the internet
4. Review access logs for signs of exploitation — look for anomalous APM policy evaluation requests
5. Rotate credentials — VPN tokens, SSL certificates, and user accounts should be treated as potentially compromised if the system was exposed

Mitigation Steps

For organizations that cannot immediately patch, the following compensating controls should be applied:

IMMEDIATE:
- Block external access to BIG-IP management interface (port 443/8443/22)
  from untrusted networks — management should be accessible only from
  dedicated management jump hosts or VLANs
 
SHORT-TERM:
- Enable F5 iRules to inspect and reject anomalous APM policy requests
- Deploy WAF rules upstream of the BIG-IP where possible
- Increase log verbosity and forward APM logs to SIEM for anomaly detection
 
MONITORING:
- Alert on: unexpected outbound connections from BIG-IP IP address
- Alert on: APM policy evaluation errors at unusual volume
- Alert on: administrative logins outside business hours

Why So Many Systems Remain Unpatched?

Network security appliances like BIG-IP are notoriously difficult to patch rapidly. Common barriers include:

• Uptime requirements — BIG-IP systems often sit in the critical path for production traffic, requiring maintenance windows
• Complex upgrade procedures — major version upgrades require careful testing to avoid application delivery disruptions
• Change management overhead — enterprise change management processes add days or weeks of delay
• License and support constraints — some organizations run versions no longer covered under active support agreements

These factors create a persistent window of vulnerability that threat actors actively exploit.

Recommended Actions

• Patch immediately using F5's official advisory and upgrade guide
• Run Shadowserver's free scanning service to confirm your own external exposure
• Check CISA KEV regularly — CVE-2025-53521 is listed with mandatory federal remediation deadlines that serve as a strong indicator of exploitation urgency
• Subscribe to F5 security advisories via F5's security RSS feed or email notification service
• Segment BIG-IP management networks as a permanent architectural hardening measure

Source: BleepingComputer — April 2, 2026