# F5 BIG-IP APM RCE Flaw Actively Exploited

Published: 2026-03-31 · Severity: high · Sectors: infrastructure, technology
Canonical: https://vorant.io/reports/e8760dd6-c419-55f0-8623-b25c28ba16ed/f5-big-ip-apm-rce-flaw-actively-exploited

> CVE-2025-53521, an unauthenticated RCE in F5 BIG-IP Access Policy Manager, is being actively exploited in the wild as of March 2026.

F5 disclosed CVE-2025-53521 on October 15, 2025, a vulnerability in BIG-IP Access Policy Manager (APM) that allows an unauthenticated attacker to execute arbitrary code remotely. On March 29, 2026, F5 confirmed active exploitation of this flaw in the wild, prompting CERT-FR to issue an alert urging affected organizations to check for compromise.

F5 has published compromise indicators associated with the exploitation, including the presence of anomalous files (/run/bigtlog.pipe, /run/bigstart.ltm), modified checksums or file sizes for /usr/bin/umount and /usr/sbin/httpd, iControl REST API calls made via a local account (f5hubblelcdadmin) to execute bash commands, and attempts to disable SELinux enforcement during exploitation. CERT-FR recommends organizations running affected BIG-IP APM versions (15.1.x before 15.1.10.8, 16.1.x before 16.1.6.1, 17.1.x before 17.1.3, and 17.5.x before 17.5.1.3) conduct compromise investigations using F5's documented indicators and apply the vendor's patches.

Given BIG-IP's widespread use as a network edge/access control appliance and the unauthenticated nature of the RCE, successful exploitation could grant attackers a foothold into internal networks. The confirmed active exploitation elevates the urgency for patching and forensic review across all affected deployments.

## Mentioned in this report

- Vulnerabilities: CVE-2025-53521 (KEV)

## Detection guidance (public sample)

### SELinux Enforcement Disabled via setenforce Command

ATT&CK: T1562.001

Detects execution of setenforce to disable or set SELinux to permissive mode, a defense-evasion step observed during BIG-IP APM RCE (CVE-2025-53521) post-exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SELinux Enforcement Disabled via setenforce Command
description: Detects the setenforce utility being invoked to disable SELinux enforcement
  or set it to permissive mode. Observed as a post-exploitation defense-evasion step
  during active exploitation of CVE-2025-53521 (F5 BIG-IP APM RCE), where attackers
  disabled SELinux to ease further tampering with host binaries.
tags:
- attack.defense_evasion
- attack.t1562.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /setenforce
    CommandLine|contains:
    - '0'
    - Permissive
    - permissive
  condition: selection
falsepositives:
- Legitimate SELinux troubleshooting or compatibility testing performed by system
  administrators
- Automated hardening/compliance scripts intentionally toggling SELinux mode during
  maintenance windows
level: high
id: 576e2c9d-c156-5d43-b872-6814ec27ae0c
status: experimental
author: Vorant
```

### Bash Command Execution Spawned by F5 iControl REST Daemons

ATT&CK: T1059

Detects bash/sh processes spawned by F5's restjavad/restnoded REST API daemons, consistent with iControl REST API abuse to execute arbitrary shell commands during BIG-IP APM RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Bash Command Execution Spawned by F5 iControl REST Daemons
description: Detects shell interpreters (bash/sh) spawned as children of F5's restjavad
  or restnoded processes, which handle iControl REST API requests. During active exploitation
  of CVE-2025-53521, attackers used the REST API with a local account (e.g. f5hubblelcdadmin)
  to execute arbitrary bash commands on the underlying BIG-IP host - a pattern not
  typical of normal REST API request handling.
tags:
- attack.execution
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /restjavad
    - /restnoded
    Image|endswith:
    - /bash
    - /sh
    - /dash
  condition: selection
falsepositives:
- Legitimate iControl REST or iApp LX extension scripts that intentionally shell out
  for automation tasks
- Vendor-supplied maintenance or upgrade scripts that interact with restjavad/restnoded
  during normal operation
level: medium
id: 7cd6006a-7c03-5ed8-8d63-058698a9fdbe
status: experimental
author: Vorant
```

### Anomalous Pipe or Control Files Created in /run Mimicking BIG-IP Processes

ATT&CK: T1190

Detects creation of unexpected named-pipe/control files under /run named to resemble legitimate BIG-IP daemons, matching artefacts left behind by CVE-2025-53521 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Anomalous Pipe or Control Files Created in /run Mimicking BIG-IP Processes
description: Detects file creation events for anomalous pipe/control files under /run
  whose names mimic legitimate BIG-IP TMOS process artefacts (e.g. bigtlog, bigstart).
  F5 identified such files as post-exploitation artefacts of CVE-2025-53521 APM RCE,
  used by attackers as staging/communication mechanisms distinct from normal BIG-IP
  runtime files.
tags:
- attack.initial_access
- attack.t1190
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|startswith: /run/big
    TargetFilename|endswith:
    - .pipe
    - .ltm
  condition: selection
falsepositives:
- Legitimate BIG-IP software upgrade or restart operations that transiently recreate
  control/status files with similar naming patterns
- F5 support-directed diagnostic captures that manually create pipe files for troubleshooting
level: high
id: 1c90b409-10cc-5361-8f3a-8bcbd4b7e394
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-004

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e8760dd6-c419-55f0-8623-b25c28ba16ed/f5-big-ip-apm-rce-flaw-actively-exploited.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup