​F5 Networks, a cybersecurity company, has changed the classification of a BIG-IP APM denial-of-service (DoS) vulnerability, now considering it a critical remote code execution (RCE) issue. They are warning that attackers are taking advantage of this flaw to install webshells on systems that haven’t been patched.

BIG-IP APM (Access Policy Manager) is a solution for managing access centrally. It allows administrators to protect and control how users access their organization’s networks, cloud resources, applications, and APIs.

Identified as CVE-2025-53521, this vulnerability allows unauthorized attackers to execute remote code on BIG-IP APM systems that have access policies configured on a virtual server.

F5 is not only saying that the vulnerability is being actively exploited but has also released indicators of compromise (IOCs) and is advising security teams to examine their BIG-IP systems’ drives, logs, and command history for signs of malicious activity.

“This vulnerability was initially identified and addressed as a Denial-of-Service (DoS) issue. However, new information obtained in March 2026 has led us to reclassify it as an RCE. The original fix for the CVE has been confirmed to resolve the RCE in the updated versions. We have become aware that this vulnerability is being exploited in vulnerable BIG-IP versions,” F5 stated in a recent security update.

“F5 highly recommends reviewing your company’s security policy for guidelines on handling security incidents, including forensic best practices specific to your organization. It’s crucial to review these policies to ensure they align with evidence collection and forensic procedures before attempting to recover the system following a security incident,” the company added.

Shadowserver, an organization that monitors internet threats, reports over 240,000 BIG-IP instances online. However, it’s unclear how many have a vulnerable configuration or have been protected against CVE-2025-53521.

​The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also added the vulnerability to its catalog of known exploited vulnerabilities on Friday, requiring federal agencies to secure their BIG-IP APM systems by the end of Monday, March 30.

“This type of vulnerability is commonly used by malicious cyber actors and presents significant risks to the federal infrastructure,” it warned.

“Follow the vendor’s instructions to apply mitigations, adhere to BOD 22-01 guidance for cloud services, or stop using the product if mitigations are not available.”

In recent years, vulnerabilities in BIG-IP have been used by nation-state actors and cybercriminals to infiltrate corporate networks, discover internal servers, distribute data-wiping malware, take over devices, and secretly steal data from victims’ networks.

F5 is a major technology company in the Fortune 500 that provides cybersecurity, application delivery networking (ADN), and other services to over 23,000 customers globally, including 48 of the Fortune 50 companies.