F5
US network security vendor; BIG-IP APM CVE-2025-53521 reclassified from medium DoS to CVSS 9.8 unauthenticated RCE in March 2026 with 14,000+ exposed instances.
Last refreshed: 17 April 2026 · Appears in 1 active topic
How did F5's patch-severity flip leave 14,000 companies exposed to remote code execution?
Timeline for F5
Reclassified CVE-2025-53521 from medium DoS to unauthenticated RCE CVSS 9.8 and confirmed memory-only web shell deployment
Cybersecurity: Threats and Defences: F5 reclassifies DoS bug to 9.8 RCE- What happened with F5 BIG-IP CVE-2025-53521?
- F5 initially rated CVE-2025-53521 as a medium-severity denial-of-service bug, but reclassified it to unauthenticated RCE with CVSS 9.8 on 28 March 2026. Shadowserver showed 14,000+ exposed instances at the time of reclassification and CISA KEV addition.Source: F5 / CISA / Shadowserver
- Why do vulnerability scores change after they are first published?
- CVSS scores are assigned based on analysis at disclosure, but exploitation evidence can change the assessed attack class. F5's CVE-2025-53521 is the 2026 reference case: a DoS classification became an RCE when exploitation was confirmed in the wild.Source: F5 / CISA
Background
F5 reclassified CVE-2025-53521 in F5 BIG-IP Access Policy Manager (APM) from a medium-severity denial-of-service vulnerability to unauthenticated Remote Code Execution (RCE) with CVSS v3.1 9.8 on 28 March 2026, after CISA added the CVE to the Known Exploited Vulnerabilities catalogue. Shadowserver scan data showed 14,000+ BIG-IP APM instances exposed at the point of reclassification. The NCSC issued an advisory on 30 March urging immediate UK operator patching.
F5 is a Major US vendor of application delivery networking and security products. Its BIG-IP platform provides load balancing, SSL offload, application firewalling and access management for enterprise and government networks globally. BIG-IP APM, specifically, is the access policy management module used for VPN, SSO and Conditional Access gateway functions — the same control-plane position as Citrix NetScaler in many organisations.
The F5 reclassification is the operational lesson in patch-triage discipline: an organisation that processed CVE-2025-53521 as a medium-priority DoS item and deferred patching was, at the point of reclassification, exposed to unauthenticated RCE on its internet-facing authentication gateway. For CISO patch-management programmes, the F5 case joins the Citrix CVSS reclassification history as evidence that severity-rating changes after initial triage are a systemic risk input that must be monitored continuously, not just at advisory publication.