CVE-2025-53521Critical· 9.8▾ Hadal⚠ Exploited in the wildWhen a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 53.9 · likelihood 0.5 · exploitation 25
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Mar 30, 2026
Last analysed / modified upstream
2.3%
Added to the CISA catalog on Mar 27, 2026. Federal remediation due Mar 30, 2026. View catalog ↗
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
big-ip_access_policy_manager >= 15.1.0, < 15.1.10.8big-ip_access_policy_manager >= 16.1.0, < 16.1.6.1big-ip_access_policy_manager >= 17.1.0, < 17.1.3big-ip_access_policy_manager >= 17.5.0, < 17.5.1.3Upgrade past the affected range:
big-ip_access_policy_manager 17.5.1.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94127Critical· 9.8When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE)
CVE-2025-61933Medium· 6.1A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-out user. Note: Software versions which have reached End of…
CVE-2025-61951High· 7.5Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. This issue may occur when a Datagram Transport Layer Security (DTLS) 1.2 virtual server is enabled with a Server SSL profile that is configured with a …
CVE-2025-61960High· 7.5When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Suppo…
CVE-2025-59269Medium· 6.1A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions whic…
CVE-2025-59481High· 8.7A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges. …