When a BIG‑IP APM access policy and an OAuth profile are enabled on a virtual server, the system can become susceptible to malformed traffic that triggers remote code execution. An attacker who is not authenticated can exploit this flaw to run arbitrary code on the device, potentially compromising the data plane functionality while the control plane remains isolated. The weakness is a classic buffer overflow (CWE‑122) that allows execution of attacker‑supplied data.

The affected products are F5 BIG‑IP devices configured with APM access policies and OAuth profiles. Versions are not specified in the advisory, so all current releases that support this configuration remain at risk until a fix is applied. The vulnerability also applies to BIG‑IP appliances operating in appliance mode.

The CVSS score of 9.3 indicates critical severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of exposure to the control plane does not reduce the risk; the data‑plane attack can still compromise the system. Attackers can craft malicious traffic directed at the vulnerable virtual server, and because the flaw does not require authentication, the threat is readily exploitable by remote parties.