Description
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Confidentiality (Vulnerable System)
High
Integrity (Vulnerable System)
High
Availability (Vulnerable System)
High
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- F5 / BIG-IP21.1.0 – Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
- F5 / BIG-IP17.5.0 – Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
- F5 / BIG-IP17.1.0 – Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
- F5 / big-ip_access_policy_manager17.0.0 – 17.1.3
- F5 / big-ip_access_policy_manager21.1.0 – 21.1.0
News coverage
- F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth ServersThe Hacker News · 9/23/2026
References
Updated 22m ago · 8 sources