CISA Warns of Critical F5 BIG-IP CVE-2023-46747 Exploit

Key Takeaways

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical vulnerability affecting F5 BIG-IP systems.
• Tracked as CVE-2025-53521, this flaw is actively being exploited in real-world attacks.
• The vulnerability could enable remote code execution (RCE) within F5 BIG-IP Access Policy Manager (APM).
• Federal agencies are mandated to apply mitigations by March 30, 2026, and all organizations using F5 BIG-IP products should prioritize immediate action.

CISA Flags Critical F5 BIG-IP Flaw as Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a significant alert, adding a newly identified vulnerability impacting F5 BIG-IP systems to its Known Exploited Vulnerabilities (KEV) catalog. This inclusion confirms that the flaw, designated CVE-2025-53521, is currently being leveraged by threat actors in active exploitation campaigns.

The vulnerability was officially listed on March 27, 2026. CISA has imposed a strict remediation deadline of March 30, 2026, for all federal agencies, underscoring the urgency of addressing this critical security risk.

Unspecified RCE in F5 BIG-IP APM

CVE-2025-53521 is described as an unspecified vulnerability residing within the F5 BIG-IP Access Policy Manager (APM) component. Its most severe implication is the potential for remote code execution (RCE), which could grant attackers significant control over affected systems.

While specific technical details remain scarce, the cybersecurity community is expressing considerable concern. The potential for exploitation without authentication or with minimal complexity, combined with the pervasive deployment of BIG-IP devices across enterprise and government infrastructures, amplifies the risk significantly.

Exploitation Confirmed and Historical Context

CISA’s directive to include CVE-2025-53521 in its KEV catalog serves as definitive confirmation of in-the-wild exploitation. Although there is no immediate public attribution to specific threat groups or evidence linking it to ransomware operations, CISA emphasizes that RCE vulnerabilities are frequently weaponized for post-compromise activities, including lateral movement within networks and data exfiltration.

Historically, F5 BIG-IP systems have been high-value targets for both state-sponsored adversaries and financially motivated cybercriminals. Their critical functions in traffic management, authentication, and secure application delivery mean that successful exploitation can provide attackers with deep access and control over core network infrastructure.

Mandatory Remediation for Federal Agencies

In response to the active threat, CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies immediately implement vendor-provided mitigations. If no patches or workarounds are available, agencies are instructed to discontinue the use of affected systems. This directive is part of Binding Operational Directive (BOD) 22-01, which compels rapid remediation of all vulnerabilities listed in the KEV catalog.

F5 has published official guidance to address this issue. Organizations are strongly advised to adhere to these mitigation steps without delay. Furthermore, security teams should conduct thorough reviews of logs and actively monitor for any indicators of compromise, paying particular attention to unusual administrative activity or unauthorized configuration changes within their BIG-IP environments.

Targeting Edge Devices: A Growing Trend

The swift addition of CVE-2025-53521 to the KEV catalog highlights a persistent trend of threat actors increasingly targeting edge devices and critical network infrastructure components. These systems often represent crucial entry points into enterprise networks, making them lucrative targets for initial access and establishing persistent footholds.

Given the limited public disclosure of technical details, defenders should operate under the assumption that exploitation techniques could evolve rapidly. Proactive security measures, such as robust network segmentation, stringent access controls, and continuous monitoring, are vital strategies for reducing exposure and mitigating potential risks.

What You Should Do

• Immediately consult F5’s official security advisories and apply all recommended patches or mitigation steps for BIG-IP products.
• Conduct an urgent review of your F5 BIG-IP Access Policy Manager (APM) configurations and logs for any signs of compromise, including unusual activity or unauthorized changes.
• Implement or reinforce network segmentation to limit the potential impact of a successful exploit.
• Strengthen access controls for BIG-IP devices, ensuring only authorized personnel have necessary permissions and that multi-factor authentication (MFA) is enforced.
• Maintain continuous monitoring of network traffic and system logs for any indicators of compromise (IOCs) related to this vulnerability.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.