Critical F5 BIG-IP Flaw Exploited by Hackers, Urgent Patch Now Available

Post Views: 7

F5 BIG-IP Vulnerability Exploited in Attacks

The F5 Networks has recently updated the severity rating of a BIG-IP APM denial-of-service (DoS) vulnerability to critical, indicating that attackers are actively exploiting it to gain unauthorized access to affected systems.

The vulnerability, tracked as CVE-2025-53521, allows hackers to execute arbitrary code remotely without requiring administrative privileges.
BIG-IP APM, or Access Policy Manager, is a central access management platform used by administrators to securely control and monitor user access to networks, cloud environments, applications, and APIs.
The compromised system is specifically vulnerable when access policies are configured on a virtual server.

Indicators of Compromise (IOCs)

F5 has released indicators of compromise (IOCs) to help detect potential malicious activity on BIG-IP systems.

Checking disk, log, and terminal history for suspicious activity.

According to F5, “The vulnerability was previously classified as a Denial-of-Service (DoS) issue but has been reassigned due to new information gathered in March 2026.”

Action Required

Administrators are urged to review their system configurations and apply patches to prevent exploitation.

Consulting their corporate security policies for incident response procedures and evidence collection protocols.

US Cybersecurity and Infrastructure Security Agency (CISA) Alert

The US Cybersecurity and Infrastructure Security Agency (CISA) has listed the vulnerability as an actively exploited flaw, mandating that federal agencies secure their BIG-IP APM systems by March 30.

Failing to take prompt action could result in significant risks to federal enterprises.
Emphasizing the urgency of applying vendor-recommended mitigations or discontinuing use of the product if mitigations are unavailable.

Nation-state and cybercrime groups have previously exploited BIG-IP vulnerabilities to breach corporate networks, deploy data-wiping malware, hijack devices, and steal sensitive documents.