A Vulnerability in F5 BIG-IP Access Policy Manager Could Allow for Remote Code Execution

A vulnerability has been discovered in F5 BIG-IP Access Policy Manager (APM) that could allow for remote code execution. BIG-IP APM is a widely deployed network access and identity management solution used across government agencies, financial institutions, healthcare organizations, and large enterprises to control application and network access. Successful exploitation of this vulnerability could result in an attacker gaining full control of the affected system. Depending on the privileges associated with the account, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Accounts configured to have fewer user rights on the system could be less impacted than those that operate with administrative user rights.

F5 has confirmed that this vulnerability has been exploited in the wild.

A vulnerability has been discovered in F5 BIG-IP Access Policy Manager (APM) that could allow for remote code execution. Details of this vulnerability are as follows:

Tactic:Initial Access(TA0001):

Technique:Exploit Public-Facing Application(T1190):

Successful exploitation of this vulnerability could result in an attacker gaining full control of the affected system.

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®