TechTarget and Informa Tech’s Digital Business Combine. TechTarget and Informa TechTarget and Informa Tech’s Digital Business Combine. Together, we power an unparalleled network of 220+ online properties covering 10,000+ granular topics, serving an audience of 50+ million professionals with original, objective content from trusted sources. We help you gain critical insights and make more informed decisions across your business priorities. Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise Newsletter Sign-Up Newsletter Sign-Up Cybersecurity Topics Related Topics Application Security Cybersecurity Careers Cloud Security Cyber Risk Cyberattacks & Data Breaches Cybersecurity Analytics Cybersecurity Operations Data Privacy Endpoint Security ICS/OT Security Identity & Access Mgmt Security Insider Threats IoT Mobile Security Perimeter Physical Security Remote Workforce Threat Intelligence Vulnerabilities & Threats Recent in Cybersecurity Topics Sponsored Content The Future of Application Security: AI Bots, APIs & Identity Explained The Future of Application Security: AI Bots, APIs & Identity Explained by Terry Sweeney Mar 31, 2026 Application Security AI-Driven Code Surge Is Forcing a Rethink of AppSec AI-Driven Code Surge Is Forcing a Rethink of AppSec by Terry Sweeney Mar 30, 2026 World Related Topics DR Global Middle East & Africa Asia Pacific Latin America Recent in World See All Application Security Real-Time Banking Trojan Strikes Brazil's Pix Users Real-Time Banking Trojan Strikes Brazil's Pix Users by Alexander Culafi Mar 13, 2026 4 Min Read Threat Intelligence Iran's Cyber-Kinetic War Doctrine Takes Shape Iran's Cyber-Kinetic War Doctrine Takes Shape by Alexander Culafi Mar 6, 2026 4 Min Read The Edge DR Technology Events Related Topics Upcoming Events Podcasts Webinars SEE ALL Resources Related Topics Resource Library Newsletters Podcasts Reports Videos Webinars White Papers Partner Perspectives Dark Reading Resource Library Application Security Cyberattacks & Data Breaches Cyber Risk Vulnerabilities & Threats News F5 BIG-IP Vulnerability Reclassified as RCE, Under Exploitation CVE-2025-53521 was initially disclosed in October as a high-severity denial-of-service (DoS) flaw, but new information has revealed the bug is actually much more dangerous. Rob Wright , Senior News Director , Dark Reading March 30, 2026 3 Min Read Source: SOPA Images Limited via Alamy stock photo A critical security vulnerability in F5's BIG-IP application security product line, which was first disclosed in October as a high-severity denial-of-service (DoS) flaw, is under active exploitation in the wild. F5 on Saturday also re-categorized CVE-2025-53521 as a remote code execution (RCE) flaw with a 9.8 CVSS score. The vulnerability initially was disclosed and patched on Oct. 15, when it was described as a DoS bug for the BIG-IP Access Policy Manager, with a CVSS score of 7.5. Because of "new information obtained in March 2026," the CVE was revised as an RCE flaw with a significantly higher severity rating, according to F5's updated advisory . It's unclear what the new information entailed. Dark Reading contacted F5 for comment but the company did not respond by press time. CVE-2025-53521 Under Attack F5 also warned in the updated advisory that CVE-2025-53521 has been exploited in the wild. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Related: AI-Driven Code Surge Is Forcing a Rethink of AppSec According to F5, a threat actor can exploit the critical bug by sending "specific malicious traffic" to virtual servers configured with BIG-IP AMP, which would give them RCE capabilities. BIG-IP AMP versions 17.5.0 to 17.5.1, 17.1.0 to 17.1.2, 16.1.0 to 16.1.6, and 15.1.0 to 15.1.10 are vulnerable. F5 urged customers to upgrade to a fixed version. The network security vendor also said BIG-IP systems in running in appliance mode , which restricts administrative access to the systems, are still vulnerable to the flaw. F5 separately published indicators of compromise (IoCs) for the exploitation activity against CVE-2025-53521. The company noted that in cases of the successful deployment of malicious software tracked as c05d5254, organizations may detect files on disk such as /run/bigtlog.pipe and /run/bigstart.ltm, as well as mismatches of file sizes, hashes, and timestamps for known good versions of known good versions of /usr/bin/umount and /usr/sbin/httpd. The IoCs also included log entries, commands, and other tactics, techniques, and procedures used by the attackers. Cybersecurity vendor Defused, meanwhile, said it observed scanning activity for CVE-2025-53521 following the addition of the flaw to CISA's KEV catalog . "This actor is hitting /mgmt/shared/identified-devices/config/device-info, which is a F5 BIG-IP REST API endpoint used to retrieve system-level information, such as hostname, machine ID, and base MAC address," Defused said on Friday in a post on social media platform X . Related: Storm Brews Over Critical, No-Click Telegram Flaw It's unclear when the exploitation activity first began. Simo Kohonen, founder and CEO of Defused, tells Dark Reading that his company's BIG-IP honeypots are "more or less under attack consistently." However, he says the company has observed some notable changes in the threat activity since Friday, including new ways of fingerprinting F5 instances. "Generic mass exploiters consistently use the same type of payload, but we've observed minor deviations to the payloads in the past week, which suggests more actors out there are looking at mapping out F5 infrastructure," Kohonen says. F5 products have been frequently targeted by a wide range of threat actors. Last year, nation-state attackers breached F5 and stole sensitive data, including source code for the BIG-IP platform. Given the increased risk posed by CVE-2025-53521, F5 customers should update their software and review their systems for any signs of compromise. About the Author Rob Wright Senior News Director, Dark Reading Rob Wright is a longtime reporter with more than 25 years of experience as a technology journalist. Prior to joining Dark Reading as senior news director, he spent more than a decade at TechTarget's SearchSecurity in various roles, including senior news director, executive editor and editorial director. Before that, he worked for several years at CRN, Tom's Hardware Guide, and VARBusiness Magazine covering a variety of technology beats and trends. Prior to becoming a technology journalist in 2000, he worked as a weekly and daily newspaper reporter in Virginia, where he won three Virginia Press Association awards in 1998 and 1999. He graduated from the University of Richmond in 1997 with a degree in journalism and English. A native of Massachusetts, he lives in the Boston area. See more from Rob Wright Want more Dark Reading stories in your Google search results? Add Us Now More Insights Industry Reports Frost Radar™: Non-human Identity Solutions 2026 CISO AI Risk Report Cybersecurity Forecast 2026 The ROI of AI in Security ThreatLabz 2025 Ransomware Report Access More Research Webinars Building a Robust SOC in a Post-AI World Retail Security: Protecting Customer Data and Payment Systems Rethinking SSE: When Unified SASE Delivers the Flexibility Enterprises Need Securing Remote and Hybrid Work Forecast: Beyond the VPN AI-Powered Threat Detection: Beyond Traditional Security Models More Webinars Editor's Choice Cybersecurity Operations Why Stryker's Outage Is a Disaster Recovery Wake-Up Call Why Stryker's Outage Is a Disaster Recovery Wake-Up Call by Jai Vijayan Mar 12, 2026 5 Min Read Want more Dark Reading stories in your Google search results? 2026 Security Trends & Outlooks Threat Intelligence Cybersecurity Predictions for 2026: Navigating the Future of Digital Threats Jan 2, 2026 Cyber Risk Navigating Privacy and Cybersecurity Laws in 2026 Will Prove Difficult Jan 12, 2026 | 7 Min Read Endpoint Security CISOs Face a Tighter Insurance Market in 2026 Jan 5, 2026 | 7 Min Read Threat Intelligence 2026: The Year Agentic AI Becomes the Attack-Surface Poster Child Jan 30, 2026 | 8 Min Read Download the Collection Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox. Subscribe Webinars Building a Robust SOC in a Post-AI World Thurs, March 19, 2026 at 1pm EST Retail Security: Protecting Customer Data and Payment Systems Thurs, April 2, 2026 at 1pm EST Rethinking SSE: When Unified SASE Delivers the Flexibility Enterprises Need Wed, April 1, 2026 at 1pm EST Securing Remote and Hybrid Work Forecast: Beyond the VPN Tues, March 10, 2026 at 1pm EST AI-Powered Threat Detection: Beyond Traditional Security Models Wed, March 25, 2026 at 1pm EST More Webinars White Papers Autonomous Pentesting at Machine Speed, Without False Positives Fixing Organizations' Identity Security Posture Best practices for incident response planning Industry Report: AI, SOC, and Modernizing Cybersecurity The Threat Prevention Buyer's Guide: Find the best AI-driven threat protection solution to stop file-based attacks. Explore More White Papers Black Hat Asia | Marina Bay Sands, Singapore Experience cutting-edge cybersecurity insights in this four-day event featuring expert Briefings on the latest research, Arsenal tool demos, a vibrant Business Hall, networking opportunities, and more. Use code DARKREADING for a Free Business Pass or $200 off a Briefings Pass. GET YOUR PASS GISEC GLOBAL 2026 GISEC GLOBAL is the most influential and the largest cybersecurity gathering in the Middle East & Africa, uniting global CISOs, government leaders, technology buyers, and ethical hackers for three power-packed days of innovation, strategy, and live cyber drills. 📌 Book Your Space Discover More Black Hat Omdia Working With Us About Us Adverti