← Back to browse · API

CVE-2025-53521

Severity
CRITICAL
CVSS
9.3
EPSS
0.02213
Risk score
62.97
CISA KEV
Yes
PoC
No
Published
2025-10-15
Modified
2026-03-31
First seen
2026-08-07
Aliases
EUVD-2025-34630, GHSA-J3CP-7WH4-9F6C
Products
F5:BIG-IP, F5:BIG-IP 15.1.0 <15.1.10.8, F5:BIG-IP 16.1.0 <16.1.6.1, F5:BIG-IP 17.1.0 <17.1.3, F5:BIG-IP 17.5.0 <17.5.1.3
Sources
cisa.gov CVE-2025-53521
euvd EUVD-2025-34630

Description

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

References