CVE-2025-53521

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 8, 2026

Description

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published
Oct 15, 2025
Last modified
Oct 8, 2026
Added to CISA KEV
Mar 27, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-535226.9Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unaCVE-2025-535234.8Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, anCVE-2025-535247.8Fuji Electric Monitouch V-SFT-6 is vulnerable to an out-of-bounds write while processing a specially crafted project file, which may allow CVE-2025-535256.1WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the profile_familCVE-2025-535266.1WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php. After the memo was CVE-2025-535279.8WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of CVE-2025-535287.6Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI. In versions before 5.4.3, the version parametCVE-2025-535299.8WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profile_funcionarCVE-2025-53537.8A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentialCVE-2025-535307.5WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to aCVE-2025-535317.5WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to aCVE-2025-535325.3giscus is a commenting system powered by GitHub Discussions. A bug in giscus' discussions creation API allowed an unauthorized user to creat
CVE-2025-53521: Critical severity, CVSS 9.8 | Vulnix