F5 BIG-IP (APM access policy): Specific malicious traffic against a virtual server with a BIG-IP APM access policy

Impact

Specific malicious traffic against a virtual server with a BIG-IP APM access policy configured leads to remote code execution. This is part of F5's October 2025 mass-remediation advisory issued after the nation-state breach of F5's internal systems and BIG-IP source code, and it's confirmed in CISA's KEV catalog — treat any internet- or cluster-VPN-facing BIG-IP APM instance as a priority target.

Who can reach it

Remote, against a virtual server that has an APM access policy applied — F5 has not disclosed full exploitation prerequisites, consistent with a critical RCE that's actively tracked as exploited.

What to do

Software upgrade to the fixed BIG-IP version per F5 K000156741, then reboot/failover. Because this is part of the breach-remediation batch, treat the whole BIG-IP estate as needing review — not just this one CVE — and prioritize any unit that's End of Technical Support, since F5 does not evaluate or patch those.

References