Shadowserver, a nonprofit that monitors internet security threats, has identified more than 14,000 BIG-IP APM installations accessible online amidst active attacks exploiting a critical vulnerability that allows for remote code execution (RCE).

BIG-IP APM (Access Policy Manager) is F5’s solution for managing access centrally, helping administrators protect their organizations’ networks, cloud resources, applications, and APIs.

The vulnerability, identified as CVE-2025-53521, is five months old and was initially classified in October as a denial-of-service (DoS) issue but was recently upgraded to an RCE flaw.

“Based on new information from March 2026, the vulnerability’s category is changed to RCE. The original fix addresses the RCE in the updated versions. We have evidence that this vulnerability is being exploited on vulnerable BIG-IP versions,” F5 stated in an updated advisory on Sunday.

Attackers, without needing special access, utilize this vulnerability to execute code remotely on BIG-IP APM systems that haven’t been patched and have access policies configured on a virtual server.

While it’s unclear how many internet-exposed BIG-IP APM systems are configured vulnerably, Shadowserver stated on Wednesday that they are tracking more than 17,100 IPs with BIG-IP APM signatures.

Shadowserver’s data indicates above 14,000 BIG-IP APM instances on the internet are at risk to CVE-2025-53521 attacks. This is occurring even after CISA instructed federal agencies to secure their BIG-IP APM systems by Monday midnight (following its inclusion on adding to the list of vulnerabilities known to be actively exploited on Friday).

F5 has also published indicators of compromise (IOCs), recommending that security teams examine the disks, logs, and terminal history of BIG-IP systems for evidence of malicious activity and offers instruction on necessary actions if compromise is suspected, including completely rebuilding affected devices.

“If customers are unsure when their systems were compromised, configuration backups may have been created post-compromise,” the company stated.

“F5 suggests rebuilding the configuration from a reliable source since configuration files from compromised systems might contain persistent malware.”

F5, a Fortune 500 tech enterprise, delivers cybersecurity, application delivery networking (ADN), and related services to over 23,000 customers, including 48 of the Fortune 50.

BIG-IP vulnerabilities have been previously exploited by nation-state actors and cybercriminals to breach company networks, take control of equipment, deploy data-wiping applications, map internal systems, and exfiltrate sensitive data.