DaystoPatch

F5Exploited incident

BIG-IP APM flaw disclosed as DoS in Oct 2025, reclassified as exploited RCE in Mar 2026

CVE-2025-53521Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 27 Mar 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE record CVE-2025-53521 (CNA: F5)CuratedQuote verified

    "assignerShortName":"f5","dateReserved":"2025-10-03T23:04:38.083Z","datePublished":"2025-10-15T13:55:52.694Z"

    Disclosed with fixes in F5's October 2025 security release, described then as a denial-of-service bug. Exploitation was only reported when F5 reclassified it in late March 2026.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:541da41ccad2cbfa…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    runZero blogCuratedQuote verified15 Oct 2025

    On October 15, 2025, F5 disclosed a denial of service vulnerability, designated CVE-2025-53521, in F5 BIG-IP Access Policy Manager (APM).

    Source
    runZero blog research
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1ddd0764e0fc5bfc…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-53521ClaimedQuote verified15 Oct 2025, 13:55 UTC

    When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:541da41ccad2cbfa…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-53521)ClaimedQuote verified27 Mar 2026

    F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

    Added to CISA's KEV catalog on 2026-03-27.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet27 Mar 2026, 20:13 UTC

    CVE-2025-53521 F5 BIG-IP Remote Code Execution Vulnerability

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet28 Mar 2026, 02:00 UTC

    🚨 [CISA-2026:0327] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:0327 ) CISA has added one new vulnerability to its Known

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE record CVE-2025-53521 (CNA: F5)CuratedQuote verified

    "datePublished":"2025-10-15T13:55:52.694Z"

    F5's advisory K000156741 is JavaScript-only and could not be quoted.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:541da41ccad2cbfa…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Arctic Wolf security bulletinCuratedQuote verified

    The original fixes released in October 2025 are reported to mitigate the now-documented RCE vector.

    The source dates the fixes only to 'October 2025'; the day is the disclosure date (F5 shipped the fixed releases with the October 2025 disclosure). BleepingComputer quotes F5: 'This known vulnerability was previously categorized and remediated as a Denial-of-Service (DoS) vulnerability.'

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3e0e0c7213433a34…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    CVE record CVE-2025-53521 (CNA: F5), affected versionsCuratedQuote verified

    "version":"15.1.0","lessThan":"15.1.10.8"

    Fixed versions for all four supported trains: 17.5.1.3, 17.1.3, 16.1.6.1, 15.1.10.8. The record was rewritten on 2026-03-27/31 (an archived copy from 2026-03-27 20:32Z already shows the RCE text), so the October 2025 version list could not be read directly; Arctic Wolf says the original October 2025 fixes cover the RCE vector.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:541da41ccad2cbfa…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • BIG-IP APM
How we built this timeline

Two-phase incident. 15 Oct 2025: disclosed as a medium-severity DoS (CVSS v4 8.7 per secondary sources) with fixes, in the same release window as F5's October 2025 breach disclosure (CISA Emergency Directive the same day). 27 Mar 2026 (Friday): F5 updated the CVE entry (record dateUpdated 27 Mar 2026) to RCE, CVSS 9.8, citing 'new information obtained in March 2026', and said it is exploited to deploy web shells; KEV the same day;

Arctic Wolf says F5 updated the advisory on 28 Mar 2026. Because the fixes predate any exploitation report, exploited before a fix is false and exposure is zero, even though customers were told for five months it was only a DoS.

Reviewers may want a separate field for the reclassification.

Related

F5 report card