{"id":"CVE-2025-53521","published":"2025-10-15T14:15:48Z","modified":"2026-10-08T12:10:00Z","title":"F5 BIG-IP Stack-Based Buffer Overflow Vulnerability","vendor":"F5","product":"BIG-IP","tier":"core","eol":null,"description":{"text":"When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).  \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","provenance":"source","from":"NVD"},"summary":{"text":"A stack-based buffer overflow in F5 BIG-IP affects the handling of traffic on virtual servers where a BIG-IP APM access policy is configured. An attacker who can send specially crafted malicious traffic to such a virtual server can achieve remote code execution, with no authentication or user interaction required and only the APM access policy configuration on the virtual server as a precondition.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:55Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.02295,"percentile":0.83214,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2026-03-27","dueDate":"2026-03-30","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Please adhere to F5’s guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible F5 products affected by this vulnerability. For more information please see: https://my.f5.com/manage/s/article/K000156741 ; https://my.f5.com/manage/s/article/K000160486 ; https://my.f5.com/manage/s/article/K11438344 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53521","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-03-27","exploitedFirstSeen":"2026-03-27","ransomware":false,"evidence":[{"url":"https://my.f5.com/manage/s/article/K000156741","date":"2026-03-27"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-03-27"},{"url":"https://labs.beazley.security/advisories/BSL-A1163","date":"2026-03-30"},{"url":"https://www.recordedfuture.com/blog/march-2026-cve-landscape","date":"2026-04-13"},{"url":"https://cyble.com/blog/monthly-threat-landscape-march-2026/","date":"2026-04-20"},{"url":"https://thecyberexpress.com/march-2026-threat-landscape/","date":"2026-04-22"},{"url":"https://infosec.exchange/@ESETresearch/116460555146536345","date":"2026-04-24"},{"url":"https://beazley.security/insights/quarterly-threat-report-first-quarter-2026","date":"2026-05-14"},{"url":"https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit","date":"2026-09-07"}],"evidenceTotal":9,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-121","name":"Stack-based Buffer Overflow"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000156741","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Malicious traffic to public-facing virtual server","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"specific malicious traffic can lead to Remote Code Execution (RCE)","start":67,"end":133}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote code execution achieved on appliance","mappingType":"primary_impact","evidence":[{"from":"description","quote":"can lead to Remote Code Execution (RCE)","start":94,"end":133}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-34630","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34630","exploited":true,"exploitedSince":"2026-03-27","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2025-10-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53521","provenance":"source"},{"date":"2026-03-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://my.f5.com/manage/s/article/K000156741","provenance":"source"},{"date":"2026-03-27","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-03-27","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34630","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":163},"priority":{"score":66.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 217 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.64,"detail":"percentile 0.8321"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-f5-big-ip-cwe-121"}}