CISA Warns of F5 BIG-IP Vulnerability Actively Exploited in Attacks

CISA added CVE-2025-53521—an RCE vulnerability in F5 BIG-IP Access Policy Manager—to its Known Exploited Vulnerabilities catalog on March 27, 2026, citing active exploitation and imposing a March 30, 2026 remediation deadline for federal agencies; F5 has published mitigations and organizations are urged to apply them immediately, monitor for signs of compromise, and implement network segmentation and strict access controls to reduce exposure.