Critical · published October 15, 2025
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 83.1th percentile for exploit probability.
🚨 A crafty attacker can hijack your server with just a well-timed malicious request! This vulnerability in BIG-IP APM access policy can lead to full Remote Code Execution (RCE) — that's a big deal! 🔥 Think of it like a sneaky delivery driver who gets access to your building because they have a fake package slip. They can walk right in through the virtual front door and take whatever they want, potentially wreaking havoc on your systems. An attacker leveraging this vulnerability could execute arbitrary code on your server, leading to data breaches, unauthorized access, and possibly complete control over your infrastructure. Picture a data thief roaming freely through your sensitive files—absolutely devastating for any organization!
Think of it like a sneaky delivery driver who gets access to your building because they have a fake package slip. They can walk right in through the virtual front door and take whatever they want, potentially wreaking havoc on your systems. This RCE vulnerability occurs when a BIG-IP APM access policy is configured on a virtual server, allowing malicious traffic to execute untrusted code due to improper input validation.
An attacker leveraging this vulnerability could execute arbitrary code on your server, leading to data breaches, unauthorized access, and possibly complete control over your infrastructure. Picture a data thief roaming freely through your sensitive files—absolutely devastating for any organization! Immediately patch to the latest version of BIG-IP to close this critical vulnerability. Review your access policies and traffic settings to ensure they are configured securely. Don't forget to monitor your logs for any suspicious activity! You've got this! With quick action, you can protect your system from this threat and earn your security hero badge! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| f5/big-ip_access_policy_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_access_policy_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_access_policy_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_access_policy_manager | ≥ 17.5.0, < 17.5.1.3 | 17.5.1.3 |