F5 BIG-IP Systems Under Active Attack as CISA Flags Critical Zero-Day

CISA added CVE-2025-53521 to its Known Exploited Vulnerabilities catalog on 27 March, giving federal agencies just three days to patch this F5 BIG-IP Application Policy Manager flaw before the 30 March deadline passes. The vulnerability affects F5 BIG-IP systems, which are enterprise-grade load balancers and application delivery controllers used to manage and secure network traffic across critical infrastructure.

Originally dismissed as a denial-of-service issue when disclosed in February, security researchers reclassified the flaw as remote code execution after discovering active exploitation campaigns throughout March 2026. According to reporting from Help Net Security, attackers are leveraging the vulnerability to gain complete system control over unpatched BIG-IP deployments.

Key Facts:
- CVE-2025-53521 enables remote code execution on F5 BIG-IP APM systems without authentication
- CISA classified the vulnerability as actively exploited, triggering emergency federal patching requirements
- The flaw was initially categorised as denial-of-service before researchers confirmed RCE capabilities
- F5 released patches in February, but many enterprise deployments remain unpatched

What Makes This Different From Recent Enterprise Attacks?

Unlike recent supply chain compromises targeting development tools, this vulnerability sits at the perimeter of enterprise networks. F5 BIG-IP systems typically handle incoming traffic before it reaches internal systems, making successful exploitation a gateway to broader network compromise. The NCSC's guidance on perimeter security emphasises that load balancer compromises often provide attackers with privileged network positions that bypass traditional monitoring.

The timing mirrors other critical infrastructure targeting seen across UK networks this year, suggesting coordinated efforts to exploit enterprise networking equipment before patches are deployed.

Boardroom Questions

• Do we have an inventory of all F5 BIG-IP systems in our environment and their current patch status?
• What is our maximum acceptable timeline for patching critical vulnerabilities on perimeter devices?
• If our load balancer was compromised tomorrow, what internal systems would be immediately accessible to attackers?

Quick Diagnostic

• Can your IT team identify all F5 BIG-IP systems in your network within the next hour?
• Have you applied F5's February 2026 security updates to all BIG-IP deployments?
• Do you have network monitoring that would detect unusual traffic patterns from your load balancer systems?