CISA Issues Three-Days Patch Mandate for Critical 9.8 F5 BIG-IP RCE

CISA has added a critical RCE vulnerability (CVE-2025-53521, CVSS 9.8) affecting F5 BIG-IP Access Policy Manager to its Known Exploited Vulnerabilities catalog after evidence of active exploitation; federal agencies are mandated to remediate by March 30, 2026, and organizations are urged to patch or migrate unsupported versions to prevent interception of encrypted traffic, lateral movement, and persistent access.