Cybersecurity firm F5 Networks has reclassified a vulnerability affecting BIG-IP Access Policy Manager (APM), from a denial-of-service (DoS) issue to a critical pre-authentication remote code execution (RCE) flaw following new findings in March 2026, with active exploitation now confirmed in the wild. The vulnerability, tracked as CVE-2025-53521, enables unauthenticated attackers to execute arbitrary code on affected systems with configured access policies, facilitating webshell deployment, including fileless variants operating in memory, and potentially leading to full system compromise. The Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and mandated remediation by no later than March 30, 2026. With over 240,000 BIG-IP instances exposed online, the attack surface remains significant, and researchers have observed active scanning activity targeting specific REST API endpoints to enumerate device information. F5 has released extensive indicators of compromise, including suspicious file artifacts, altered system binaries, anomalous log entries tied to unauthorized iControl REST API access and SELinux tampering, as well as stealthy HTTP traffic patterns designed to obscure attacker activity. Historically targeted by both nation-state and financially motivated threat actors for network intrusion, lateral movement, data exfiltration, and destructive attacks, BIG-IP devices represent a high-value target, and this reclassification from a lower-priority DoS vulnerability to actively exploited RCE underscores a substantial escalation in risk, requiring immediate patching, log analysis, and adherence to incident response and forensic best practices. CTIX analysts urge all administrators to patch their instances and follow the F5 guidelines to prevent exploitation.