CISA adds CVE-2025-53521 (F5 BIG-IP APM) to KEV after active exploitation

What happened

CISA added CVE-2025-53521 (affecting F5 BIG-IP APM) to the Known Exploited Vulnerabilities (KEV) catalog on 2026-03-27, which means exploitation has been observed in the wild.

KEV inclusion is a practical priority signal: this is no longer a theoretical bug, and exposed systems should be treated as urgent remediation work.

Why this matters

BIG-IP APM is often deployed on internet-facing authentication and access paths. When a flaw in this area is actively exploited, it can create risk for remote access availability and potentially deeper compromise if mitigation is delayed.

Even organizations outside federal mandates should treat KEV-listed edge/authentication vulnerabilities as near-term patch priorities.

How to check if you’re affected

You are likely affected if you operate F5 BIG-IP appliances and use APM (Access Policy Manager) on reachable virtual servers.

Inventory F5 BIG-IP exposure
- Identify all internet-facing BIG-IP systems and confirm whether APM policies are enabled.
Match versions against vendor guidance
- Compare your deployed versions with the fixed/mitigated versions listed by F5 in advisory K000156741.
Review logs for suspicious behavior
- Check for unexplained service instability, crashes/restarts, or unusual requests targeting APM paths.
Prioritize edge-facing systems first
- Patch/mitigate external-facing appliances before internal-only instances.
Apply compensating controls if patching is delayed
- Restrict exposure to trusted networks, enforce strict access controls, and increase monitoring until full remediation is complete.

Immediate defensive actions

Apply vendor mitigations/patches for CVE-2025-53521 immediately.
Validate that internet-exposed APM entry points are minimized and tightly controlled.
Alert SOC/IR teams to watch for signs of exploitation attempts around BIG-IP APM traffic.

Sources

Bottom line

If your organization runs F5 BIG-IP APM, treat CVE-2025-53521 as a same-day remediation item. KEV status means attackers are already using this path, so speed matters.