Critical 9.8
KEV-listed
CVE-2025-53521
F5 BIG-IP APM Exploitation via CVE-2025-53521 and PoisonedRefresh Malware
Vendor / product: F5 BIG-IP APM
Event date: 2026-03-27
Public PoC: Yes
First tracked by RiskWire: 2026-09-07
CISA KEV catalog
Added to KEV
Federal remediation due
2026-03-30 (174 days overdue)
Ransomware campaign use
Unknown
CISA description
F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Sources & citations (4)
- PoisonedRefresh Malware Backdoors F5 BIG-IP Servers With Memory-Only PHP Web Shells gbhackers.com · 2026-09-07
- Linux Rootkit Injects Fileless PHP Web Shells Into Compromised F5 BIG-IP Servers cybersecuritynews.com · 2026-09-07
- F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans thehackernews.com · 2026-09-09
- Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit bleepingcomputer.com · 2026-09-08
References
See CVE-2025-53521 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →