BIG-IP APM CVE-2025-54854
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach APM OAuth virtual server
-
ExploitSend crafted undisclosed traffic
-
ExecutionTrigger out-of-bounds read in apmd
-
ImpactCrash apmd and deny access-policy services
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only when a BIG-IP APM OAuth access profile configured specifically as a Resource Server or Resource Client is bound to a virtual server - this feature-enabled, non-default configuration is the precise prerequisite. Where that configuration is present, the CVSS vector indicates no authentication, user interaction, or special access is needed (PR:N/UI:N/AC:L), so any host able to send traffic to the affected virtual server can trigger the apmd termination. Limiting factors: deployments without the APM OAuth Resource Server/Client profile are not affected, and End of Technical Support software versions were not evaluated; impact is confined to availability (service crash/DoS), with no confidentiality or integrity consequence. |
| Impact | Signals are consistent and point to a genuine but bounded denial-of-service risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated trigger, and the impact set is availability-only (VC:N/VI:N/VA:H) - matching the description that undisclosed traffic terminates the apmd process. EPSS is low (0.35%, 26th percentile), there is no CISA KEV listing, and no public exploit code is referenced, so this is 'no public exploit identified at time of analysis.' The main contrast is between the easy, unauthenticated reachability (which justifies the 8.7 score) and the limited blast radius: a crash/DoS of the access-policy daemon, not code execution or data theft. A notable conflict is in the metadata: the Tags include 'Information Disclosure' and 'Buffer Overflow', but the authoritative CVSS shows VC:N (no confidentiality impact) and the CWE is CWE-125 (out-of-bounds read) producing an availability impact - so treat this as a DoS, not an info-leak or classic buffer overflow. Overall: a real priority for organizations running the affected APM OAuth configuration (availability of authentication services is business-critical), but not a widespread drive-by threat. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted (undisclosed) traffic to a BIG-IP virtual server that has an APM OAuth access profile (Resource Server or Resource Client) configured, triggering an out-of-bounds read that terminates the apmd process. The resulting crash denies access-policy processing (SSO/authentication) to legitimate users until the service recovers. No public proof-of-concept is referenced, and the exact triggering packet remains undisclosed by F5. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Denial of service in F5 BIG-IP Access Policy Manager (APM) can be triggered by undisclosed network traffic when an APM OAuth access profile is configured as a Resource Server or Resource Client on a virtual server, causing the apmd process to terminate. This non-default configuration is the prerequisite; where present, an unauthenticated remote attacker can send traffic that crashes the process without user interaction, affecting availability only. No public exploit code has been identified, and EPSS indicates a low likelihood of exploitation (0.35%, 26th percentile); the F5 advisory K000156602 provides further details.
RemediationAI
No specific patched version is identified in the provided data; apply the remediation from F5 advisory K000156602 (https://my.f5.com/manage/s/article/K000156602) as soon as it becomes available. As an immediate workaround, if the OAuth Resource Server or Resource Client profile is not required, remove or disable it from the affected virtual servers; this eliminates the vulnerability but disables OAuth functionality for that virtual server. If the profile is necessary, restrict network access to the affected virtual server using firewall rules or network ACLs to only trusted sources, understanding that this may not fully mitigate the risk if legitimate clients are widely distributed. Monitor the F5 advisory for hotfixes or updated guidance. There is no vendor-released patch version specified in the available intelligence, so verify current patch status directly with F5.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an out-of-bounds read (CWE-125) in the apmd process, which is part of F5 BIG-IP Access Policy Manager (APM). The apmd process handles access policy enforcement, including OAuth Resource Server and Resource Client profiles. When such a profile is bound to a virtual server, malformed or unexpected network traffic can cause the process to read beyond the bounds of allocated memory, leading to a crash. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) confirms that the attack is network-accessible, requires no privileges or user interaction, and results in high availability impact with no confidentiality or integrity impact. The CPE strings identify F5 BIG-IP Access Policy Manager as the affected product, but no specific version ranges are included in the CPE data; consult F5 advisory K000156602 for exact affected versions. The tags 'Buffer Overflow' and 'Information Disclosure' are also associated, though the primary consequence is a denial of service.
Know when Big Ip Access Policy Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated traffic (AV:N/AC:L/PR:N/UI:N) crashes apmd for an availability-only impact (A:H; C:N/I:N); no scope change beyond the affected component.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
DescriptionCVE.org
When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Executive ViewAI
F5 BIG-IP Access Policy Manager (APM) is affected by a denial-of-service condition that can terminate the apmd process, degrading or interrupting traffic handling on virtual servers where an APM OAuth access profile is configured as a Resource Server or Resource Client. The exposure is limited to organizations using that non-default configuration, but where it is present, authentication-dependent applications and services could become unavailable without warning and without user interaction. Leadership should care about availability risk to business-critical application access, while noting that no public exploit code has been identified at time of analysis and no vendor-released patch currently exists.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove the APM OAuth access profile configured as a Resource Server or Resource Client on affected virtual servers where it is not operationally required; restrict network access to affected virtual servers to trusted sources; confirm BIG-IP high-availability/failover readiness and monitor for apmd process terminations and restarts; track F5 advisory K000156602 for a fixed software release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
More in Big Ip Access Policy Manager
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver a
F5 BIG-IP APM (Access Policy Manager) contains a remote code execution vulnerability triggered by specific malicious tra
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may
F5 BIG-IP contains an authenticated command injection in the iControl REST API and TMOS Shell (tmsh) save command. Authe
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BI
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
GitHub PoC
Exploit-DB