When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, the system can become susceptible to malformed traffic that triggers remote code execution. An attacker who is not authenticated can exploit this flaw to run arbitrary code on the device, potentially compromising the data plane functionality while the control plane remains isolated. The weakness is a classic buffer overflow (CWE-122) that allows execution of attacker‑supplied data.

The affected products are F5 BIG‑IP devices configured with APM access policies and OAuth profiles. Versions are not specified in the advisory, so all current releases that support this configuration remain at risk until a fix is applied. The vulnerability also applies to BIG‑IP appliances operating in appliance mode.

The CVSS score of 9.3 indicates critical severity. The EPSS score is 1%, indicating a low but nonzero likelihood of exploitation, and the vulnerability is listed in the CISA KEV catalog, underscoring its importance. The lack of exposure to the control plane does not reduce the risk; the data‑plane attack can still compromise the system. Attackers can craft malicious traffic directed at the vulnerable virtual server, and because the flaw does not require authentication, the threat is readily exploitable by remote parties. The likely attack vector is crafted network traffic targeting the virtual server exposed by the APM OAuth Authorization Server configuration.