Which versions of BIG-IP APM are affected by CVE-2026-40067?

F5 BIG-IP Access Policy Manager (APM) is vulnerable to unauthenticated remote denial of service attacks that can crash critical authentication infrastructure, impacting all user access dependent on…. A patch is available.

How to fix or mitigate CVE-2026-40067?

Within 24 hours: identify all BIG-IP APM deployments and confirm current versions against F5 advisory K000161056. Within 7 days: apply vendor-released patches per advisory K000161056 to all APM instances; prioritize production authentication infrastructure. Within 30 days: verify patch deployment across all environments and implement network segmentation to restrict APM virtual server access if patches cannot be immediately applied.

BIG-IP APM CVE-2026-40067

Q: What is the CVSS score of CVE-2026-40067?

CVE-2026-40067 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29971 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-13 f5

GHSA-7864-ffq2-g598

Buffer Overflow Big Ip

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

May 13, 2026 - 15:45 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 7.5

DescriptionCVE.org

When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Remote denial of service in F5 BIG-IP Access Policy Manager (APM) allows unauthenticated attackers to crash the apmd process by sending specially crafted traffic to virtual servers with APM access policies configured. The vulnerability stems from a buffer overflow (CWE-120) and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). EPSS data not provided; no CISA KEV listing indicates no confirmed widespread exploitation at time of analysis. F5 has released vendor patches per advisory K000161056.

Technical ContextAI

This vulnerability affects F5 BIG-IP's Access Policy Manager (APM), a module that provides secure, centralized access control for applications and networks. The apmd daemon is the core APM process responsible for policy evaluation and enforcement. The root cause is a buffer overflow (CWE-120), a memory safety issue where input data exceeds allocated buffer boundaries, typically caused by insufficient bounds checking on network input parsing. When APM access policies are applied to virtual servers-the logical interfaces that receive client traffic-the apmd process becomes vulnerable to malformed or oversized packets that trigger the overflow condition. The CPE string cpe:2.3:a:f5:big-ip indicates this affects the BIG-IP application platform broadly, though specific vulnerable versions are not enumerated in the available data. Buffer overflows in network-facing daemons are particularly concerning as they can be triggered remotely without authentication.

RemediationAI

Apply vendor-released patches immediately per F5 Security Advisory K000161056 available at https://my.f5.com/manage/s/article/K000161056, which provides specific fixed versions for affected BIG-IP releases. F5 typically releases hotfixes and recommends upgrading to maintained software branches. If immediate patching is not feasible, implement compensating controls: restrict network access to BIG-IP management and virtual server interfaces using firewall rules or access control lists to trusted IP ranges, reducing exposure to untrusted internet traffic; monitor apmd process health and configure automated restart mechanisms to restore service quickly if crashes occur, noting this mitigates availability impact but does not prevent exploitation; disable APM access policies on non-critical virtual servers where APM functionality is not essential, eliminating the attack surface entirely for those endpoints (verify business impact before disabling). Apply patches during the next available maintenance window as these workarounds do not address the root vulnerability. Organizations should test patches in non-production environments first, as APM changes can affect authentication flows for critical applications.