CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation

CISA added CVE-2025-53521 — a critical F5 BIG-IP APM flaw now understood to allow pre-auth remote code execution (CVSS v4 9.3) — to its KEV catalog citing in-the-wild exploitation. F5 updated advisories and published IOCs and TTPs (file/hash mismatches, modified webtop renderer files, webshell activity in memory, specific HTTP response patterns); multiple BIG-IP versions are impacted and federal agencies were given an urgent patch deadline.