F5 BIG-IP APM RCE Flaw Actively Exploited
CVE-2025-53521, an unauthenticated RCE in F5 BIG-IP Access Policy Manager, is being actively exploited in the wild as of March 2026.
F5 disclosed CVE-2025-53521 on October 15, 2025, a vulnerability in BIG-IP Access Policy Manager (APM) that allows an unauthenticated attacker to execute arbitrary code remotely. On March 29, 2026, F5 confirmed active exploitation of this flaw in the wild, prompting CERT-FR to issue an alert urging affected organizations to check for compromise.
F5 has published compromise indicators associated with the exploitation, including the presence of anomalous files (/run/bigtlog.pipe, /run/bigstart.ltm), modified checksums or file sizes for /usr/bin/umount and /usr/sbin/httpd, iControl REST API calls made via a local account (f5hubblelcdadmin) to execute bash commands, and attempts to disable SELinux enforcement during exploitation. CERT-FR recommends organizations running affected BIG-IP APM versions (15.1.x before 15.1.10.8, 16.1.x before 16.1.6.1, 17.1.x before 17.1.3, and 17.5.x before 17.5.1.3) conduct compromise investigations using F5's documented indicators and apply the vendor's patches.
Given BIG-IP's widespread use as a network edge/access control appliance and the unauthenticated nature of the RCE, successful exploitation could grant attackers a foothold into internal networks. The confirmed active exploitation elevates the urgency for patching and forensic review across all affected deployments.
Mentioned in this report
Detection guidance
SELinux Enforcement Disabled via setenforce Command
Detects execution of setenforce to disable or set SELinux to permissive mode, a defense-evasion step observed during BIG-IP APM RCE (CVE-2025-53521) post-exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SELinux Enforcement Disabled via setenforce Command
description: Detects the setenforce utility being invoked to disable SELinux enforcement
or set it to permissive mode. Observed as a post-exploitation defense-evasion step
during active exploitation of CVE-2025-53521 (F5 BIG-IP APM RCE), where attackers
disabled SELinux to ease further tampering with host binaries.
tags:
- attack.defense_evasion
- attack.t1562.001
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /setenforce
CommandLine|contains:
- '0'
- Permissive
- permissive
condition: selection
falsepositives:
- Legitimate SELinux troubleshooting or compatibility testing performed by system
administrators
- Automated hardening/compliance scripts intentionally toggling SELinux mode during
maintenance windows
level: high
id: 576e2c9d-c156-5d43-b872-6814ec27ae0c
status: experimental
author: Vorant
Bash Command Execution Spawned by F5 iControl REST Daemons
Detects bash/sh processes spawned by F5's restjavad/restnoded REST API daemons, consistent with iControl REST API abuse to execute arbitrary shell commands during BIG-IP APM RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Bash Command Execution Spawned by F5 iControl REST Daemons
description: Detects shell interpreters (bash/sh) spawned as children of F5's restjavad
or restnoded processes, which handle iControl REST API requests. During active exploitation
of CVE-2025-53521, attackers used the REST API with a local account (e.g. f5hubblelcdadmin)
to execute arbitrary bash commands on the underlying BIG-IP host - a pattern not
typical of normal REST API request handling.
tags:
- attack.execution
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /restjavad
- /restnoded
Image|endswith:
- /bash
- /sh
- /dash
condition: selection
falsepositives:
- Legitimate iControl REST or iApp LX extension scripts that intentionally shell out
for automation tasks
- Vendor-supplied maintenance or upgrade scripts that interact with restjavad/restnoded
during normal operation
level: medium
id: 7cd6006a-7c03-5ed8-8d63-058698a9fdbe
status: experimental
author: Vorant
Anomalous Pipe or Control Files Created in /run Mimicking BIG-IP Processes
Detects creation of unexpected named-pipe/control files under /run named to resemble legitimate BIG-IP daemons, matching artefacts left behind by CVE-2025-53521 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Anomalous Pipe or Control Files Created in /run Mimicking BIG-IP Processes
description: Detects file creation events for anomalous pipe/control files under /run
whose names mimic legitimate BIG-IP TMOS process artefacts (e.g. bigtlog, bigstart).
F5 identified such files as post-exploitation artefacts of CVE-2025-53521 APM RCE,
used by attackers as staging/communication mechanisms distinct from normal BIG-IP
runtime files.
tags:
- attack.initial_access
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|startswith: /run/big
TargetFilename|endswith:
- .pipe
- .ltm
condition: selection
falsepositives:
- Legitimate BIG-IP software upgrade or restart operations that transiently recreate
control/status files with similar naming patterns
- F5 support-directed diagnostic captures that manually create pipe files for troubleshooting
level: high
id: 1c90b409-10cc-5361-8f3a-8bcbd4b7e394
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-004
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free