Unauthenticated RCE in F5 BIG‑IP APM (CVE‑2025‑53521) – Immediate Mitigation Required

What Happened

The National Cyber Security Centre (NCSC) has identified an unauthenticated remote code execution vulnerability in F5 BIG‑IP Access Policy Manager, assigned CVE‑2025‑53521. The flaw allows an attacker to execute arbitrary code on the appliance without authentication.

Impact

Any organisation running F5 BIG‑IP APM, especially large enterprises that rely on the appliance for authentication and access control, is at risk. Successful exploitation could lead to full system compromise, data exfiltration, or service disruption.

Mitigation Steps

Defenders should:

• Verify that the appliance is running a patched version (consult F5 release notes for the latest fix).
• If a patch is not yet available, apply the vendor‑issued workaround or configuration change as detailed in the NCSC advisory.
• Restrict network access to the APM management interface to trusted IP ranges.
• Enable logging and monitor for anomalous authentication or configuration changes.
• Conduct a quick audit of any exposed APM instances to ensure no unauthorized access.

Additional Recommendations

Maintain a regular patch management cadence, keep an inventory of all F5 appliances, and consider network segmentation to isolate APM from critical assets. Report any suspicious activity to the NCSC via MyNCSC or the national incident reporting portal.