F5 BIG-IP Access Policy Manager (versions 17.1.0–17.5.1 and 21.1.0)

The flaw exists in how BIG-IP APM processes traffic to a virtual server when both an APM access policy and an OAuth profile are active together. Malformed or specifically crafted requests to that configuration bypass authentication entirely, giving the attacker a direct path to code execution. The vulnerability lives on the data plane — the part of the appliance that handles live network traffic — meaning it can be triggered from outside the organisation without any internal access.

An unauthenticated attacker sends a specially crafted request to the virtual server running BIG-IP APM in OAuth Authorization Server mode. The appliance processes the malicious traffic without verifying who sent it, executing the attacker's payload and granting them full control of the device. No phishing, no credentials, no foothold required — just a network connection to the exposed service.

1. Review the three indicators of compromise (IoCs) published in F5's advisory and cross-reference them against your BIG-IP APM logs immediately.
2. Look for unexpected outbound connections or unusual processes spawned on the appliance following inbound OAuth-related traffic.
3. Monitor for authentication events on the virtual server that lack corresponding valid session records — a sign that someone probed the OAuth endpoint without a legitimate token.

1. Apply F5's hotfix immediately — affected versions are 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0.
2. If patching is not immediately possible, remove the OAuth Authorization Server configuration from exposed virtual servers as a temporary mitigation.
3. Check CISA's Known Exploited Vulnerabilities catalogue and follow BOD 26-04 if your organisation is a federal agency — the patch deadline is three days from the advisory.