BIG-IP APM CVE-2026-40067

Exploitation requires the target BIG-IP system to have an APM access policy explicitly configured and applied to a virtual server that receives the attacker's traffic. This is the specific deployment prerequisite stated in the vulnerability description-BIG-IP systems without APM policies configured or with APM enabled but not applied to virtual servers are not vulnerable. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N indicates no additional limiting factors: attackers need only network connectivity to the virtual server (typically TCP port 443 for APM HTTPS access), require no authentication credentials, no user interaction, and face low attack complexity. The vulnerability is not limited by non-default configurations beyond the fundamental requirement of having APM policies in use. The scope is unchanged (S:U), meaning the vulnerable component (apmd) and impacted component are the same, so exploitation does not extend beyond the APM subsystem to affect other BIG-IP modules or the underlying system kernel.

Real-world risk assessment requires balancing multiple signals. The CVSS v3.1 base score of 7.5 (High) reflects maximum attack convenience: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), resulting in high availability impact (A:H) with no confidentiality or integrity effects. However, the impact is limited to denial of service-crashing the apmd process disrupts APM functionality but does not enable code execution, data exfiltration, or lateral movement. The absence of CISA KEV listing and the generic 'undisclosed traffic' language in the description suggest this is not yet widely exploited in the wild, likely due to specificity of deployment (requires APM policies on virtual servers) and potentially complex exploitation conditions not detailed in public disclosure. EPSS probability data is missing, limiting statistical risk quantification. The availability of vendor patches significantly reduces long-term risk for organizations with mature patch management. Priority should be HIGH for internet-facing BIG-IP APM deployments, MEDIUM for internal APM instances with compensating network controls. Key uncertainty: specific BIG-IP versions affected are not enumerated in available data-organizations must consult F5 advisory K000161056 directly to determine applicability to their environment.

An unauthenticated attacker identifies an internet-facing F5 BIG-IP virtual server with APM access policies enabled through reconnaissance of SSL/TLS certificate metadata or login page characteristics. The attacker crafts malformed network packets exploiting the buffer overflow in apmd's input parsing logic and sends them to the target virtual server. The apmd process terminates due to memory corruption, causing active APM sessions to drop and preventing new authentication requests until the process restarts, effectively denying legitimate users access to applications protected by APM policies.