VORANT. Threat Intelligence Sign in Get the full feed

F5 BIG-IP APM RCE exploited in wild

critical vulnerability financial-servicesgovernment-nationaltechnology

F5 confirms active exploitation of CVE-2025-53521, a remote code execution flaw in BIG-IP APM versions 15.x through 17.x affecting enterprises and government organizations.

F5 has confirmed active exploitation of CVE-2025-53521, a critical remote code execution vulnerability affecting BIG-IP Access Policy Manager (APM). The flaw impacts versions 15.x (15.1.0–15.1.10), 16.x (16.1.0–16.1.6), and 17.x (17.1.0–17.1.2 and 17.5.0–17.5.1). When an APM access policy is configured on a virtual server, attackers can send specially crafted malicious traffic to achieve remote code execution.

Successful exploitation allows attackers to execute arbitrary code with the privileges of the vulnerable service, potentially enabling them to install programs, view or modify data, delete information, or create new accounts with full administrative rights. The severity of impact depends on the privilege level of the compromised service account. F5 BIG-IP APM is widely deployed by enterprises, financial institutions, and government organizations for centralized access policy management, authentication, and authorization across internal and remote environments.

F5 has released patches in versions 15.1.10.8, 16.1.6.1, 17.1.3, and 17.5.1.3. Organizations running affected versions should prioritize immediate patching, particularly given confirmed in-the-wild exploitation. Additional mitigations include network segmentation to isolate internet-facing APM instances, application of least-privilege principles, and deployment of exploit protection capabilities where available.

Mentioned in this report

Vulnerabilities CVE-2025-53521KEV

Detection guidance

Suspicious Child Process Spawned by F5 BIG-IP APM/TMM Service Processes

ATT&CK T1190

Detects shell or interpreter processes spawned from F5 BIG-IP APM-related daemons (tmm, apmd, bigd, restjavad), consistent with post-exploitation of CVE-2025-53521 RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process from F5 BIG-IP APM Daemon
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /tmm
    - /apmd
    - /bigd
    - /restjavad
    - /httpd
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
    - /python
    - /python3
    - /perl
    - /curl
    - /wget
    - /nc
    - /ncat
  filter_known_health:
    CommandLine|contains:
    - /usr/bin/tmsh
    - monitor
  condition: selection_parent and selection_child and not filter_known_health
falsepositives:
- Legitimate BIG-IP health-check or configuration scripts invoking shell utilities
  from tmm/apmd during normal operation
- iControl REST or tmsh automation scripts triggered by administrators through restjavad
level: high
tags:
- attack.t1190
- attack.execution
id: 37607a24-478c-52f5-88e1-565bb9b18a3d
status: experimental
author: Vorant

F5 BIG-IP Service Process Spawning Outbound Network Connection

ATT&CK T1190

Detects outbound network connections initiated directly by F5 BIG-IP APM/TMM related processes, which may indicate reverse shell or C2 activity following exploitation of CVE-2025-53521. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Outbound Connection Initiated by F5 BIG-IP APM Process
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
    - /tmm
    - /apmd
    - /bigd
    - /restjavad
    Initiated: true
  filter_internal:
    DestinationIp|startswith:
    - '10.'
    - 172.16.
    - 192.168.
    - '127.'
  condition: selection and not filter_internal
falsepositives:
- Normal BIG-IP cluster or HA sync traffic between management processes and internal
  peers not covered by the internal IP filter
- Licensing or update checks initiated by BIG-IP daemons to F5 cloud services
level: medium
tags:
- attack.t1190
- attack.command_and_control
id: 4871a6ff-a30f-5918-a459-6c38a9a9683a
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-f5-products-could-allow-for-remote-code-execution_2026-026

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free