# CVE-2025-53521: F5 BIG-IP APM Unauthenticated Remote Code Execution via Stack-based Buffer Overflow

> CVE-2025-53521 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in F5 BIG-IP Access Policy Manager affecting the apmd process. Originally disclosed in October 2025 as a denial-of-service issue, it was reclassified as RCE in March 2026 after evidence of active exploitation by Chinese nation-state actor UNC5221. CISA added it to the KEV catalog on March 27, 2026.

- **Published:** 2026-04-01T12:00:00Z
- **Last reviewed:** 2026-04-01T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0307
- **ID:** TL-2026-0307
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UNC5221 (China)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-53521

## Description

CVE-2025-53521 is a critical pre-authentication remote code execution vulnerability in the apmd process of F5 BIG-IP Access Policy Manager (APM). The vulnerability is triggered when a BIG-IP APM access policy is configured on a virtual server and the system receives specially crafted malicious traffic, causing a stack-based buffer overflow (CWE-121) that leads to arbitrary code execution with root privileges.

The vulnerability was initially disclosed on October 15, 2025 and classified as a denial-of-service issue with a CVSS score of 8.7. However, in March 2026, F5 reclassified the vulnerability as remote code execution after new intelligence revealed that the flaw was being actively exploited by a sophisticated nation-state threat actor. The updated CVSS scores are 9.8 (v3.1) and 9.3 (v4.0), reflecting the pre-authentication attack vector requiring no user interaction.

The exploitation is linked to UNC5221, a China-nexus threat cluster that maintained persistent access to F5's internal network for at least 12 months prior to discovery in August 2025. During this period, the attackers accessed BIG-IP source code and vulnerability intelligence, which facilitated the development of the exploit. Post-compromise, attackers deployed the BRICKSTORM backdoor — a statically-linked Go ELF executable that uses TLS with HTTP/2 ALPN negotiation, WebSocket upgrade capability, and Yamux multiplexing for concurrent C2 streams over a single socket.

The observed attack chain proceeds as follows: (1) Reconnaissance via queries to /mgmt/shared/identified-devices/config/device-info to enumerate vulnerable systems; (2) Exploitation of the apmd process on internet-exposed APM instances achieving root-level code execution; (3) Persistence through SSH key injection into /root/.ssh/authorized_keys and /home/tmadmin/.ssh/authorized_keys, modification of systemd units, and deployment of in-memory webshells; (4) Defense evasion by modifying sys-eicheck (system integrity checker) and disabling SELinux; (5) Credential harvesting via iControl REST API interception and SSO token theft; (6) Lateral movement using the compromised APM as a pivot point to downstream internal and SaaS systems.

Indicators of compromise include the presence of /run/bigtlog.pipe and /run/bigstart.ltm persistence files, hash mismatches in /usr/bin/umount and /usr/sbin/httpd binaries, webshell modifications to PHP files under /var/sam/www/webtop/renderer/, and HTTP/S traffic containing HTTP 201 response codes with CSS content-type headers used for C2 obfuscation. POST requests to http://localhost:8100/mgmt/tm/util/bash with HTTP 200 responses indicate post-exploitation command execution.

The vulnerability affects BIG-IP APM versions 15.1.0-15.1.10, 16.1.0-16.1.6, 17.1.0-17.1.2, and 17.5.0-17.5.1, as well as BIG-IP systems in Appliance mode. F5 released patches in October 2025 that address the vulnerability. CISA added CVE-2025-53521 to the Known Exploited Vulnerabilities catalog on March 27, 2026, with a mandatory federal agency remediation deadline of March 30, 2026. The Dutch National Cyber Security Center (NCSC-NL) independently confirmed active exploitation on March 30, 2026.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1543 Create or Modify System Process
- T1098 Account Manipulation
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1572 Protocol Tunneling
- T1090 Proxy
- T1020 Automated Exfiltration
- T1041 Exfiltration Over C2 Channel
- T1499 Endpoint Denial of Service

## Sources

- [NVD - CVE-2025-53521](https://nvd.nist.gov/vuln/detail/CVE-2025-53521)
- [F5 Security Advisory K000156741](https://my.f5.com/manage/s/article/K000156741)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [SOCRadar - CVE-2025-53521 Reclassified as RCE](https://socradar.io/blog/cve-2025-53521-f5-big-ip-apm-flaw-rce/)
- [CISA Adds CVE-2025-53521 to KEV - The Hacker News](https://thehackernews.com/2026/03/cisa-adds-cve-2025-53521-to-kev-after.html)
- [Attackers exploiting RCE in BIG-IP APM - Help Net Security](https://www.helpnetsecurity.com/2026/03/28/big-ip-apm-vulnerability-cve-2025-53521-exploited/)
- [Resecurity - F5 BIG-IP Source Code Leak and BRICKSTORM Backdoor](https://www.resecurity.com/blog/article/f5-big-ip-source-code-leak-tied-to-state-linked-campaigns-using-brickstorm-backdoor)
- [UK NCSC Advisory - Vulnerability affecting F5 BIG-IP APM](https://www.ncsc.gov.uk/news/vulnerability-affecting-f5-big-ip-apm)
- [NHS England Digital - Critical RCE in F5 BIG-IP Under Exploitation](https://digital.nhs.uk/cyber-alerts/2026/cc-4763)
- [Qualys ThreatPROTECT - CISA Warns about CVE-2025-53521](https://threatprotect.qualys.com/2026/03/30/cisa-warns-about-active-exploitation-of-f5-big-ip-vulnerability-cve-2025-53521/)
- [eSentire - F5 BIG-IP APM Flaw Exploited in the Wild](https://www.esentire.com/security-advisories/f5-big-ip-apm-flaw-cve-2025-53521-exploited-in-the-wild)
- [Hadrian - F5 BIG-IP APM RCE Active Exploitation](https://hadrian.io/blog/f5-big-ip-apm-remote-code-execution-cve-2025-53521-active-exploitation)
- [CISA/NSA BRICKSTORM Backdoor Malware Analysis Report](https://media.defense.gov/2025/Dec/04/2003834878/-1/-1/0/MALWARE-ANALYSIS-REPORT-BRICKSTORM-BACKDOOR.PDF)
- [CyCognito - Emerging Threat CVE-2025-53521](https://www.cycognito.com/blog/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521/)
- [F5 BIG-IP DoS Flaw Upgraded to Critical RCE - SecurityWeek](https://www.securityweek.com/f5-big-ip-dos-flaw-upgraded-to-critical-rce-now-exploited-in-the-wild/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0307