--- title: Fortinet BIG-IP Vuln Reclassified as RCE, Under Exploitation description: CVE-2025-53521, a vulnerability in Fortinet's BIG-IP Access Policy Manager, has been reclassified from a high-severity denial-of-service flaw to a critical... canonical: https://daily.dev/posts/fortinet-big-ip-vuln-reclassified-as-rce-under-exploitation-3gdeh2jrm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Fortinet BIG-IP Vuln Reclassified as RCE, Under Exploitation | daily.dev og:description: CVE-2025-53521, a vulnerability in Fortinet's BIG-IP Access Policy Manager, has been reclassified from a high-severity denial-of-service flaw to a critical... og:url: https://daily.dev/posts/fortinet-big-ip-vuln-reclassified-as-rce-under-exploitation-3gdeh2jrm og:image: https://api.daily.dev/og/posts/3gdEh2jrM.png og:image:alt: Fortinet BIG-IP Vuln Reclassified as RCE, Under Exploitation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Fortinet BIG-IP Vuln Reclassified as RCE, Under Exploitation **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 1 upvotes · 1 comments ## Summary CVE-2025-53521, a vulnerability in Fortinet's BIG-IP Access Policy Manager, has been reclassified from a high-severity denial-of-service flaw to a critical remote code execution (RCE) bug with a CVSS score of 9.8. Originally disclosed and patched in October 2025, new information obtained in March 2026 prompted the reclassification. The flaw is now under active exploitation, with CISA adding it to its Known Exploited Vulnerabilities catalog. Affected BIG-IP versions span 15.1.x through 17.5.x, and even systems in appliance mode remain vulnerable. Fortinet has published indicators of compromise, including specific file artifacts and log entries. Separately, a critical SQL injection flaw in FortiClient EMS (CVE-2026-21643) is also being actively exploited, with nearly 1,000 publicly exposed instances identified on Shodan. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Fortinet fixes two critical RCE flaws in FortiAuthenticator and FortiSandbox](https://daily.dev/posts/fortinet-fixes-two-critical-rce-flaws-in-fortiauthenticator-and-fortisandbox-sfl19vmql) · CSO Online · 1 upvotes · 0 comments - [Critical Fortinet sandbox bugs allow auth bypass and RCE](https://daily.dev/posts/critical-fortinet-sandbox-bugs-allow-auth-bypass-and-rce-av1wd0io9) · The Register · 0 upvotes · 0 comments - [CVE-2025-25249: Remote Code Execution Vulnerability in FortiOS and FortiSwitchManager](https://daily.dev/posts/cve-2025-25249-remote-code-execution-vulnerability-in-fortios-and-fortiswitchmanager-joa3ypxd0) · Arctic Wolf · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability), [#fortinet](https://daily.dev/tags/fortinet) [View this post on daily.dev](https://daily.dev/posts/fortinet-big-ip-vuln-reclassified-as-rce-under-exploitation-3gdeh2jrm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Fortinet BIG-IP Vuln Reclassified as RCE, Under Exploitation","url":"https://daily.dev/posts/fortinet-big-ip-vuln-reclassified-as-rce-under-exploitation-3gdeh2jrm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fortinet-big-ip-vuln-reclassified-as-rce-under-exploitation-3gdeh2jrm"},"datePublished":"2026-03-30T20:07:53.827Z","dateModified":"2026-03-30T20:08:28.940Z","description":"CVE-2025-53521, a vulnerability in Fortinet's BIG-IP Access Policy Manager, has been reclassified from a high-severity denial-of-service flaw to a critical...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8dda6f7b39066c69c252bf606f6764a7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8dda6f7b39066c69c252bf606f6764a7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/fortinet-big-ip-vuln-reclassified-as-rce-under-exploitation-3gdeh2jrm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,vulnerability,fortinet","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Fortinet BIG-IP Vuln Reclassified as RCE, Under Exploitation"}]} ```