ctrlINT What the industry said about every indicator, with the quote

CVE-2025-53521Vulnerability

F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 2 independent sources · first reported by Sophos X-Ops · last reported

Last reported 1 month ago

CISA KEVAdded 27 Mar 2026
Fix due 30 Mar 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS2.3%
higher than 83% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

2 reports, newest first · the exact sentence from each

  1. “Another APM flaw, CVE-2025-53521, was added to CISA's KEV catalog in March.”

    The Hacker NewsNews
    F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

  2. “F5 associates the related c05d5254 activity with BIG-IP APM systems affected by CVE-2025-53521, an exploited unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server.”

    Sophos X-OpsVendor
    Dissecting a PHP web server rootkit

Indicators reported together

named in the same reports
Copy these 2 indicators · defanged

Also named with it: CVE-2026-94127

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2025-53521 here?
No account needed. We do not store your IP address.