F5 BIG-IP APM RCE Flaw Actively Exploited
CVE-2025-53521, an unauthenticated RCE in F5 BIG-IP Access Policy Manager, is being actively exploited in the wild as of March 2026.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-53521 as exploited in the wild.
F5 disclosed CVE-2025-53521 on October 15, 2025, a vulnerability in BIG-IP Access Policy Manager (APM) that allows an unauthenticated attacker to execute arbitrary code remotely. On March 29, 2026, F5 confirmed active exploitation of this flaw in the wild, prompting CERT-FR to issue an alert urging affected organizations to check for compromise.
F5 has published compromise indicators associated with the exploitation, including the presence of anomalous files (/run/bigtlog.pipe, /run/bigstart.ltm), modified checksums or file sizes for /usr/bin/umount and /usr/sbin/httpd, iControl REST API calls made via a local account (f5hubblelcdadmin) to execute bash commands, and attempts to disable SELinux enforcement during exploitation. CERT-FR recommends organizations running affected BIG-IP APM versions (15.1.x before 15.1.10.8, 16.1.x before 16.1.6.1, 17.1.x before 17.1.3, and 17.5.x before 17.5.1.3) conduct compromise investigations using F5's documented indicators and apply the vendor's patches.
Given BIG-IP's widespread use as a network edge/access control appliance and the unauthenticated nature of the RCE, successful exploitation could grant attackers a foothold into internal networks. The confirmed active exploitation elevates the urgency for patching and forensic review across all affected deployments.
Mentioned in this report
Detection guidance
SELinux Enforcement Disabled via setenforce Command
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects execution of setenforce to disable or set SELinux to permissive mode, a defense-evasion step observed during BIG-IP APM RCE (CVE-2025-53521) post-exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SELinux Enforcement Disabled via setenforce Command
description: Detects the setenforce utility being invoked to disable SELinux enforcement
or set it to permissive mode. Observed as a post-exploitation defense-evasion step
during active exploitation of CVE-2025-53521 (F5 BIG-IP APM RCE), where attackers
disabled SELinux to ease further tampering with host binaries.
tags:
- attack.defense-impairment
- attack.t1685
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /setenforce
CommandLine|contains:
- '0'
- Permissive
- permissive
condition: selection
falsepositives:
- Legitimate SELinux troubleshooting or compatibility testing performed by system
administrators
- Automated hardening/compliance scripts intentionally toggling SELinux mode during
maintenance windows
level: high
id: 576e2c9d-c156-5d43-b872-6814ec27ae0c
status: experimental
author: Vorant
Bash Command Execution Spawned by F5 iControl REST Daemons
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects bash/sh processes spawned by F5's restjavad/restnoded REST API daemons, consistent with iControl REST API abuse to execute arbitrary shell commands during BIG-IP APM RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Bash Command Execution Spawned by F5 iControl REST Daemons
description: Detects shell interpreters (bash/sh) spawned as children of F5's restjavad
or restnoded processes, which handle iControl REST API requests. During active exploitation
of CVE-2025-53521, attackers used the REST API with a local account (e.g. f5hubblelcdadmin)
to execute arbitrary bash commands on the underlying BIG-IP host - a pattern not
typical of normal REST API request handling.
tags:
- attack.execution
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /restjavad
- /restnoded
Image|endswith:
- /bash
- /sh
- /dash
condition: selection
falsepositives:
- Legitimate iControl REST or iApp LX extension scripts that intentionally shell out
for automation tasks
- Vendor-supplied maintenance or upgrade scripts that interact with restjavad/restnoded
during normal operation
level: medium
id: 7cd6006a-7c03-5ed8-8d63-058698a9fdbe
status: experimental
author: Vorant
Anomalous Pipe or Control Files Created in /run Mimicking BIG-IP Processes
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of unexpected named-pipe/control files under /run named to resemble legitimate BIG-IP daemons, matching artefacts left behind by CVE-2025-53521 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Anomalous Pipe or Control Files Created in /run Mimicking BIG-IP Processes
description: Detects file creation events for anomalous pipe/control files under /run
whose names mimic legitimate BIG-IP TMOS process artefacts (e.g. bigtlog, bigstart).
F5 identified such files as post-exploitation artefacts of CVE-2025-53521 APM RCE,
used by attackers as staging/communication mechanisms distinct from normal BIG-IP
runtime files.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|startswith: /run/big
TargetFilename|endswith:
- .pipe
- .ltm
condition: selection
falsepositives:
- Legitimate BIG-IP software upgrade or restart operations that transiently recreate
control/status files with similar naming patterns
- F5 support-directed diagnostic captures that manually create pipe files for troubleshooting
level: high
id: 1c90b409-10cc-5361-8f3a-8bcbd4b7e394
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-004
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs