{"id":2370,"date":"2026-03-30T07:43:06","date_gmt":"2026-03-30T14:43:06","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=2370"},"modified":"2026-03-30T08:16:19","modified_gmt":"2026-03-30T15:16:19","slug":"emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/","title":{"rendered":"Emerging Threat: F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521)"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"740\" src=\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352-1280x740.png\" alt=\"\" class=\"wp-image-2372\" srcset=\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352-1280x740.png 1280w, https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352-512x296.png 512w, https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352-768x444.png 768w, https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352-1536x888.png 1536w, https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352.png 1769w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><figcaption class=\"wp-element-caption\">Sample of assets impacted by CVE-2025-53521, identified by the CyCognito Platform<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">What is CVE-2025-53521?<\/h2>\n\n\n\n<p>CVE-2025-53521 is an unauthenticated remote code execution vulnerability in F5&#8217;s BIG-IP Access Policy Manager (APM). The flaw exists in the <code>apmd<\/code> process, the daemon responsible for processing live access policy traffic, and is triggered when a BIG-IP APM access policy is configured on a virtual server and the system receives specific malicious traffic. No credentials are required to exploit it.<\/p>\n\n\n\n<p>The vulnerability carries a CVSS score of 9.8 and a CVSS score of 9.3. These scores reflect a pre-authentication attack requiring no user interaction and no special conditions on the attacker&#8217;s side.<\/p>\n\n\n\n<p>Successful exploitation enables an attacker to execute arbitrary code on the affected system. From that position, an attacker can establish persistence, deploy backdoors or webshells, move laterally into the internal network, and exfiltrate data accessible from the compromised segment. BIG-IP systems deployed in Appliance mode are also affected. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).<\/p>\n\n\n\n<p>CVE-2025-53521 was initially disclosed on October 15, 2025, and classified as a denial-of-service issue. In March 2026, F5 reclassified it as a remote code execution vulnerability after new information became available. <\/p>\n\n\n\n<p>F5 confirmed the vulnerability has been exploited in affected BIG-IP versions and has published indicators of compromise, including suspicious files, log anomalies, and HTTP\/S traffic patterns associated with post-exploitation activity. CISA added the flaw to its Known Exploited Vulnerabilities catalog on March 27, 2026, and ordered US federal civilian agencies to remediate by March 30, 2026.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">What assets are affected by CVE-2025-53521?<\/h2>\n\n\n\n<p>The vulnerability affects F5 BIG-IP APM across four version branches: <code>17.5.0<\/code> through <code>17.5.1<\/code>, <code>17.1.0<\/code> through <code>17.1.2<\/code>, <code>16.1.0<\/code> through <code>16.1.6<\/code>, and <code>15.1.0<\/code> through <code>15.1.10<\/code>. Systems running BIG-IP APM with an access policy configured on a virtual server are in scope; BIG-IP deployments without APM or without an access policy on a virtual server are not directly affected by this vulnerability. Appliance mode configurations are explicitly confirmed as vulnerable.<\/p>\n\n\n\n<p>In practice, affected assets are enterprise-grade network appliances positioned at the perimeter or in front of application infrastructure. BIG-IP APM is commonly deployed to broker authentication and access for corporate VPNs, web application portals, APIs, and remote workforce access systems. These systems are routinely internet-facing by design \u2014 their purpose is to mediate external user access to internal resources \u2014 which makes them a high-value target for opportunistic and targeted attackers alike.<\/p>\n\n\n\n<p>The reclassification from DoS to RCE, combined with a known prior compromise of F5&#8217;s internal environment by a nation-state actor with access to BIG-IP source code, elevates the risk profile of any unpatched deployment. <\/p>\n\n\n\n<p>Organizations that deprioritized remediation based on the original DoS classification may have left internet-exposed BIG-IP APM systems unpatched for an extended period. Internet-wide scanning for the BIG-IP REST API endpoint <code>\/mgmt\/shared\/identified-devices\/config\/device-info<\/code> has been observed following CISA&#8217;s KEV listing, indicating active reconnaissance activity in progress.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">What does our data show about exposure patterns?<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1185\" height=\"734\" src=\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-53521_exposure_by_industry_1.png\" alt=\"\" class=\"wp-image-2375\" srcset=\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-53521_exposure_by_industry_1.png 1185w, https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-53521_exposure_by_industry_1-512x317.png 512w, https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-53521_exposure_by_industry_1-768x476.png 768w\" sizes=\"auto, (max-width: 1185px) 100vw, 1185px\" \/><\/figure>\n\n\n\n<p>Exposure in this set is led by Information Technology at 36.4% of observed assets, with Industrials contributing 21.2%.<\/p>\n\n\n\n<p>The Information Technology concentration is consistent with the role BIG-IP APM plays in enterprise access infrastructure. Software and services companies \u2014 along with technology hardware vendors \u2014 routinely deploy BIG-IP to secure developer portals, SaaS environments, customer-facing APIs, and internal tooling. <\/p>\n\n\n\n<p>These environments tend to maintain a high volume of virtual servers and access policies, increasing the surface area of affected deployments. At the same time, distributed development teams and multi-cloud architectures can introduce delays between patch availability and verified remediation across all deployed instances.<\/p>\n\n\n\n<p>The cross-sector spread, particularly the proportion falling into the Others bucket, reflects a pattern common to widely-deployed enterprise infrastructure: BIG-IP APM is not sector-specific. Organizations that acquired or inherited these deployments through mergers, partner integrations, or cloud migrations may have reduced visibility into whether access policies are configured on all virtual servers, or whether affected version branches remain in production. <\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Are fixes available?<\/h2>\n\n\n\n<p>Patches are available. F5 released fixes for CVE-2025-53521 as part of its October 2025 Quarterly Security Notification. The fixed versions are <code>17.5.2<\/code>, <code>17.1.3<\/code>, <code>16.1.7<\/code>, and <code>15.1.11<\/code>, corresponding to each affected branch. Organizations should identify their current deployed version and upgrade to the appropriate fixed release.<\/p>\n\n\n\n<p>F5 has confirmed that the October 2025 patches address the underlying vulnerability and that customers who applied them promptly may have avoided compromise. However, the advisory does not specify when active exploitation began, only that it was confirmed in March 2026. Organizations that patched but have not verified their systems against F5&#8217;s published indicators of compromise should conduct that assessment. F5&#8217;s indicators include file anomalies in <code>\/run\/bigtlog.pipe<\/code>, hash or size mismatches on <code>\/usr\/bin\/umount<\/code> or <code>\/usr\/sbin\/httpd<\/code>, and suspicious localhost iControl REST API access in audit logs.<\/p>\n\n\n\n<p>The patch status for end-of-technical-support (EoTS) versions has not been evaluated by F5. Organizations running BIG-IP APM versions outside the supported branches should consult F5 directly and should not assume patch coverage without explicit confirmation from the vendor.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Are there any other recommended actions to take?<\/h2>\n\n\n\n<p>Organizations should apply the F5-issued patches immediately and, where patching cannot occur during an active change window, isolate BIG-IP APM management interfaces from untrusted networks using ACLs or firewall policy. <\/p>\n\n\n\n<p>All internet-accessible BIG-IP APM systems should be reviewed against F5&#8217;s published indicators of compromise, including file integrity checks and audit log review \u2014 to assess whether a prior compromise occurred before the patch was applied. <\/p>\n\n\n\n<p>Management self-IP access should be restricted to trusted internal subnets or bastion hosts, and any unauthorized configuration changes, new accounts, or suspicious scripts discovered during review should be treated as indicators of active post-exploitation activity pending further forensic analysis.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">How can CyCognito help your organization?<\/h2>\n\n\n\n<p>CyCognito published an Emerging Threat Advisory for CVE-2025-53521 in the CyCognito platform and is actively researching enhanced detection capabilities for this vulnerability.<\/p>\n\n\n\n<p>To learn how CyCognito can help your organization reduce external exposure and manage emerging threats more effectively, <a href=\"https:\/\/www.cycognito.com\/demo\/\">contact us to request a demo.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A critical unauthenticated remote code execution vulnerability in F5&#8217;s BIG-IP Access Policy Manager allows attackers to execute arbitrary code on internet-facing appliances without any credentials or user interaction. Organizations running affected BIG-IP APM versions that have not yet patched, should treat their systems as potentially compromised.<\/p>\n","protected":false},"author":39,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-2370","post","type-post","status-publish","format-standard","hentry","category-research"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Emerging Threat: F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521) | CyCognito Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Emerging Threat: F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521) | CyCognito Blog\" \/>\n<meta property=\"og:description\" content=\"A critical unauthenticated remote code execution vulnerability in F5&#039;s BIG-IP Access Policy Manager allows attackers to execute arbitrary code on internet-facing appliances without any credentials or user interaction. Organizations running affected BIG-IP APM versions that have not yet patched, should treat their systems as potentially compromised.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/\" \/>\n<meta property=\"og:site_name\" content=\"CyCognito Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-03-30T14:43:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-30T15:16:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1769\" \/>\n\t<meta property=\"og:image:height\" content=\"1023\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Igal Zeifman\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Igal Zeifman\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/\"},\"author\":{\"name\":\"Igal Zeifman\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/#\/schema\/person\/79ab10bc35a38aef399f5bbd21d8f1b3\"},\"headline\":\"Emerging Threat: F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521)\",\"datePublished\":\"2026-03-30T14:43:06+00:00\",\"dateModified\":\"2026-03-30T15:16:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/\"},\"wordCount\":974,\"publisher\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352-1280x740.png\",\"articleSection\":[\"Research\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/\",\"url\":\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/\",\"name\":\"Emerging Threat: F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521) | CyCognito Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352-1280x740.png\",\"datePublished\":\"2026-03-30T14:43:06+00:00\",\"dateModified\":\"2026-03-30T15:16:19+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#primaryimage\",\"url\":\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352.png\",\"contentUrl\":\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352.png\",\"width\":1769,\"height\":1023},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.cycognito.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Emerging Threat: F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/#website\",\"url\":\"https:\/\/www.cycognito.com\/blog\/\",\"name\":\"Cycognito Blog\",\"description\":\"Research, Product News and Latest Updates\",\"publisher\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.cycognito.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/#organization\",\"name\":\"Cycognito\",\"url\":\"https:\/\/www.cycognito.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/logo-1720x550-1.png\",\"contentUrl\":\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/logo-1720x550-1.png\",\"width\":1720,\"height\":550,\"caption\":\"Cycognito\"},\"image\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/#\/schema\/person\/79ab10bc35a38aef399f5bbd21d8f1b3\",\"name\":\"Igal Zeifman\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b4495bcfbe7465d573c6f7ee3e2a3cab?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b4495bcfbe7465d573c6f7ee3e2a3cab?s=96&d=mm&r=g\",\"caption\":\"Igal Zeifman\"},\"description\":\"VP of Marketing\",\"url\":\"https:\/\/www.cycognito.com\/blog\/author\/igal-zeifman\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Emerging Threat: F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521) | CyCognito Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/","og_locale":"en_US","og_type":"article","og_title":"Emerging Threat: F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521) | CyCognito Blog","og_description":"A critical unauthenticated remote code execution vulnerability in F5's BIG-IP Access Policy Manager allows attackers to execute arbitrary code on internet-facing appliances without any credentials or user interaction. Organizations running affected BIG-IP APM versions that have not yet patched, should treat their systems as potentially compromised.","og_url":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/","og_site_name":"CyCognito Blog","article_published_time":"2026-03-30T14:43:06+00:00","article_modified_time":"2026-03-30T15:16:19+00:00","og_image":[{"width":1769,"height":1023,"url":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352.png","type":"image\/png"}],"author":"Igal Zeifman","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Igal Zeifman","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#article","isPartOf":{"@id":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/"},"author":{"name":"Igal Zeifman","@id":"https:\/\/www.cycognito.com\/blog\/#\/schema\/person\/79ab10bc35a38aef399f5bbd21d8f1b3"},"headline":"Emerging Threat: F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521)","datePublished":"2026-03-30T14:43:06+00:00","dateModified":"2026-03-30T15:16:19+00:00","mainEntityOfPage":{"@id":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/"},"wordCount":974,"publisher":{"@id":"https:\/\/www.cycognito.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352-1280x740.png","articleSection":["Research"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/","url":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/","name":"Emerging Threat: F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521) | CyCognito Blog","isPartOf":{"@id":"https:\/\/www.cycognito.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#primaryimage"},"image":{"@id":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352-1280x740.png","datePublished":"2026-03-30T14:43:06+00:00","dateModified":"2026-03-30T15:16:19+00:00","breadcrumb":{"@id":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#primaryimage","url":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352.png","contentUrl":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/CVE-2025-5352.png","width":1769,"height":1023},{"@type":"BreadcrumbList","@id":"https:\/\/www.cycognito.com\/blog\/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.cycognito.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Emerging Threat: F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521)"}]},{"@type":"WebSite","@id":"https:\/\/www.cycognito.com\/blog\/#website","url":"https:\/\/www.cycognito.com\/blog\/","name":"Cycognito Blog","description":"Research, Product News and Latest Updates","publisher":{"@id":"https:\/\/www.cycognito.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.cycognito.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.cycognito.com\/blog\/#organization","name":"Cycognito","url":"https:\/\/www.cycognito.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cycognito.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/logo-1720x550-1.png","contentUrl":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/logo-1720x550-1.png","width":1720,"height":550,"caption":"Cycognito"},"image":{"@id":"https:\/\/www.cycognito.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.cycognito.com\/blog\/#\/schema\/person\/79ab10bc35a38aef399f5bbd21d8f1b3","name":"Igal Zeifman","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cycognito.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/b4495bcfbe7465d573c6f7ee3e2a3cab?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b4495bcfbe7465d573c6f7ee3e2a3cab?s=96&d=mm&r=g","caption":"Igal Zeifman"},"description":"VP of Marketing","url":"https:\/\/www.cycognito.com\/blog\/author\/igal-zeifman\/"}]}},"_links":{"self":[{"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/posts\/2370","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/users\/39"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/comments?post=2370"}],"version-history":[{"count":3,"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/posts\/2370\/revisions"}],"predecessor-version":[{"id":2376,"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/posts\/2370\/revisions\/2376"}],"wp:attachment":[{"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/media?parent=2370"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/categories?post=2370"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/tags?post=2370"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}