When a BIG‑IP APM access policy is active on a virtual server, concealment of traffic can cause the apmd process to terminate. The crash of apmd disables the APM component, resulting in a denial of service for all connections managed by that policy. The vulnerability is rated CVSS 8.7, indicating a high‑severity outage risk.

The flaw affects F5 BIG‑IP devices that implement APM access policies. No individual firmware versions are listed; however, the advisory notes that versions no longer receiving technical support are excluded from the evaluation.

The CVSS score reflects the extent of availability loss. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting no publicly documented exploitation yet, but the lack of data does not imply absence of risk. Likely attackers can trigger the crash by sending specially crafted traffic to the virtual server that is routed through the vulnerable APM policy. With remote access to the network segment and the ability to generate such traffic, a stakeholder could incapacitate the BIG‑IP device’s APM service.