# F5 BIG-IP APM Unauthenticated Remote Code Execution via Stack Buffer Overflow (CVE-2025-53521) — CISA KEV Active Exploitation by Chinese Nation-State Actor

> Critical unauthenticated remote code execution vulnerability in F5 BIG-IP Access Policy Manager (APM) actively exploited by a Chinese nation-state threat actor. Originally disclosed as a DoS flaw in October 2025 and reclassified as RCE in March 2026 after F5 confirmed a source code breach. CISA added to KEV on March 27, 2026, with over 14,000 internet-exposed instances identified by Shadowserver.

- **Published:** 2026-04-02T12:00:00Z
- **Last reviewed:** 2026-04-02T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0312
- **ID:** TL-2026-0312
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UTA0178 (China)
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-53521

## Description

CVE-2025-53521 is a critical unauthenticated remote code execution vulnerability affecting the apmd process in F5 BIG-IP Access Policy Manager (APM). The vulnerability is a stack-based buffer overflow (CWE-121) triggered when a BIG-IP APM access policy is configured on a virtual server and the system receives specially crafted malicious traffic. Exploitation grants root-level access to the underlying operating system without requiring any authentication.

The vulnerability was initially disclosed on October 15, 2025, and classified as a denial-of-service issue. Concurrently, F5 confirmed a data breach revealing that a highly sophisticated nation-state threat actor had maintained access to F5's internal network for at least 12 months, accessing BIG-IP source code and information about undisclosed vulnerabilities. In March 2026, based on new intelligence, F5 reclassified the vulnerability from DoS to RCE with CVSS scores of 9.8 (v3.1) and 9.3 (v4.0).

Active exploitation has been confirmed by both F5 and CISA. The threat actor — attributed to China — has been observed deploying the Brickstorm backdoor, a custom implant associated with Chinese nation-state operations, on compromised F5 customer systems. Post-exploitation activity includes deployment of in-memory webshells, modification of the sys-eicheck system integrity checker to evade detection, disabling SELinux security modules, injecting SSH authorized keys for persistent access, and modifying system binaries including /usr/bin/umount and /usr/sbin/httpd.

The apmd process handles live access policy traffic and runs with elevated privileges, making it a high-value target. Exploitation is pre-authentication and requires no user interaction. Appliance mode BIG-IP systems are also vulnerable. The attack surface is significant: Shadowserver identified over 14,000 internet-exposed BIG-IP APM instances and over 17,100 total BIG-IP APM fingerprints as of April 2026. F5 serves over 23,000 customers including 48 of the Fortune 50.

F5 has warned that UCS (User Configuration Set) backups from compromised systems may contain persistent malware, advising organizations to rebuild from known-good sources rather than restoring from potentially tainted backups. The Dutch National Cyber Security Center (NCSC-NL) confirmed active abuse on March 30, 2026.

Notably, no public proof-of-concept exploit has been identified, suggesting the exploit is held privately by the threat actor — likely developed using the stolen F5 source code. This significantly increases the sophistication assessment and indicates a well-resourced, persistent adversary with deep knowledge of BIG-IP internals.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1098 Account Manipulation
- T1547 Boot or Logon Autostart Execution
- T1134 Access Token Manipulation
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1056 Input Capture
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1570 Lateral Tool Transfer
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1020 Automated Exfiltration
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking

## Sources

- [CISA KEV Entry — CVE-2025-53521](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [F5 Security Advisory K000156741: BIG-IP APM vulnerability CVE-2025-53521](https://my.f5.com/manage/s/article/K000156741)
- [F5 Security Advisory K000160486: CVE-2025-53521 Indicators of Compromise](https://my.f5.com/manage/s/article/K000160486)
- [NVD — CVE-2025-53521](https://nvd.nist.gov/vuln/detail/CVE-2025-53521)
- [BleepingComputer: Over 14,000 F5 BIG-IP APM instances still exposed to RCE attacks](https://www.bleepingcomputer.com/news/security/over-14-000-f5-big-ip-apm-instances-still-exposed-to-rce-attacks/)
- [BleepingComputer: Hackers exploiting critical F5 BIG-IP flaw in attacks](https://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-f5-big-ip-flaw-in-attacks-patch-now/)
- [Help Net Security: Attackers exploiting RCE vulnerability in BIG-IP APM systems](https://www.helpnetsecurity.com/2026/03/28/big-ip-apm-vulnerability-cve-2025-53521-exploited/)
- [Hadrian: F5 BIG-IP APM Remote Code Execution Active Exploitation](https://hadrian.io/blog/f5-big-ip-apm-remote-code-execution-cve-2025-53521-active-exploitation)
- [Arctic Wolf: CVE-2025-53521 F5 BIG-IP APM Vulnerability Reclassified as RCE](https://arcticwolf.com/resources/blog/cve-2025-53521/)
- [Qualys ThreatPROTECT: CISA Warns about Active Exploitation of F5 BIG-IP Vulnerability](https://threatprotect.qualys.com/2026/03/30/cisa-warns-about-active-exploitation-of-f5-big-ip-vulnerability-cve-2025-53521/)
- [Shadowserver Foundation BIG-IP APM Exposure Scan](https://www.shadowserver.org/)
- [eSentire: F5 BIG-IP APM Flaw CVE-2025-53521 Exploited in the Wild](https://www.esentire.com/security-advisories/f5-big-ip-apm-flaw-cve-2025-53521-exploited-in-the-wild)
- [CyCognito: Emerging Threat F5 BIG-IP APM RCE](https://www.cycognito.com/blog/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0312