CVE-2025-53521: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
Overview
F5 BIG-IP APM contains a stack-based buffer overflow in the apmd process that allows an unauthenticated remote attacker to execute arbitrary code on the data plane. The flaw is present when an APM access policy is configured on a virtual server, and the virtual server is reachable over the network. BIG-IP versions across the 15.x, 16.x, and 17.x branches are affected. F5 has confirmed active exploitation and reclassified the vulnerability from a denial-of-service issue to a remote code execution flaw after new information emerged in March 2026.
Vulnerability details
The apmd process in BIG-IP APM handles traffic for virtual servers that have an access policy attached. A stack-based buffer overflow (CWE-121) occurs when attacker-supplied input exceeds the bounds of a fixed-size stack buffer inside that process, corrupting adjacent stack memory. Because the overflow is not caught before the corrupted data influences control flow, an attacker can redirect execution to arbitrary code. No authentication is required, and the flaw sits entirely on the data plane, meaning the management control plane is not exposed through this path.
An attacker who can reach the affected virtual server over the network sends specially crafted traffic that triggers the overflow in apmd. No credentials, prior session, or user interaction are needed. Successful exploitation gives the attacker code execution within the apmd process on the BIG-IP data plane. F5 confirmed this vulnerability has been exploited in the wild, and indicators of compromise are documented in F5 advisory K000160486. Systems that ran a vulnerable version and were subsequently upgraded should still be checked for signs of prior compromise.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review F5 advisory K000160486 for the specific indicators of compromise (hash c05d5254) associated with confirmed exploitation of this vulnerability. Check all BIG-IP APM systems, including those already upgraded, if they previously ran a vulnerable version.
- Monitor for unexpected crashes, restarts, or core dumps from the apmd process on BIG-IP APM systems. Repeated apmd failures without a corresponding maintenance event are anomalous and warrant investigation on any virtual server with an APM access policy configured.
- Audit BIG-IP APM virtual server configurations to identify which virtual servers have APM access policies attached and are exposed to untrusted networks. Unexpected or unauthorized changes to access policy configuration may indicate post-exploitation activity.
Remediation
Additional hardening
- Upgrade BIG-IP APM to 17.5.1.3 or later (17.x branch), 17.1.3 or later (17.1.x branch), 16.1.6.1 or later (16.x branch), or 15.1.10.8 or later (15.x branch). Consult the vendor advisory in References for full version details.
- Restrict network access to BIG-IP APM virtual servers with APM access policies to known, trusted source IP ranges using perimeter controls or BIG-IP packet filters, reducing the attack surface for unauthenticated exploitation.
- If immediate patching is not possible, evaluate whether APM access policies can be temporarily removed from internet-facing virtual servers, eliminating the vulnerable code path until the fix is applied.
- For any system that ran a vulnerable version, follow F5 guidance in advisory K11438344 to assess whether compromise occurred before the upgrade, as active exploitation has been confirmed.
Key dates
References
Frequently asked questions
Does CVE-2025-53521 affect my FedRAMP authorization?
If F5 BIG-IP runs inside your authorization boundary, yes. CVE-2025-53521 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 30, 2026, a date that has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can already see. Your position now is to remediate and formally document the mitigation and the delay.
How does Knox help me handle CVE-2025-53521?
Knox does not patch your F5 BIG-IP software. Under the FedRAMP shared-responsibility model, that remediation belongs to you. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage to help you document the fix for your next assessment. Applying the patch is your responsibility; managing your compliance posture while you do it is not something you have to handle on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. When something like CVE-2025-53521 surfaces, exposure appears during ongoing monitoring rather than waiting until an assessor flags it at a scheduled review. That earlier signal gives your team time to act before a finding becomes a formal conversation.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2025-53521's remediation deadline of March 30, 2026 has passed. What happens now?
An unremediated CVE-2025-53521 is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out now and documenting why the deadline was missed is what keeps your authorization in good standing and the agency relationship intact.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
