U.S. CISA adds a flaw in F5 BIG-IP AMP to its Known Exploited Vulnerabilities catalog

CVE-2025-53521 is a stack-based buffer overflow (CWE-121) in F5 BIG-IP's Access Policy Manager (APM) that allows remote code execution. The flaw is triggered when a virtual server is configured with an APM access policy and receives specific malicious network traffic; no authentication or user interaction is required per the CVSS 4.0 vector. An attacker who exploits it gains remote code execution on the BIG-IP device, and in observed intrusions attackers have deployed a fileless Linux rootkit (dubbed 'PoisonedRefresh') that injects a PHP web shell into server memory to evade disk-based scanning. Any F5 BIG-IP deployment with an APM access policy configured on a virtual server is potentially affected; versions that have reached End of Technical Support are not evaluated by the vendor. The vulnerability is being actively exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-27, with active exploitation and in-memory malware campaigns confirmed in press reports, though ransomware use is unknown.

Do: Patch immediately by upgrading affected BIG-IP systems to fixed releases per F5's security advisory (note that versions in End of Technical Support will not be fixed and should be upgraded or retired), prioritizing internet-facing virtual servers with APM access policies. Because observed attacks deploy a memory-resident PHP web shell via the PoisonedRefresh Linux rootkit, disk-only scans may miss compromise — inspect running processes and memory, and hunt for suspicious PHP or rootkit activity on BIG-IP APM devices. Federal agencies must follow the required action in CISA KEV/BOD 22-01: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.