For F5 BIG-IP APM customers, CVE-2025-53521 is being exploited in the wild by a nation state threat actor
It allows unauth RCE and applies to the data plane (not the management interface) - the one available over the internet.
https://my.f5.com/manage/s/article/K000156741
Attackers have been deploying webshells, so boxes are still vuln post patching if already exploited prior.







