Introduction
An outage in authentication infrastructure can lock thousands of users out of critical business applications at once. F5 BIG-IP Access Policy Manager (APM) is widely deployed in enterprise environments for identity and access management, so a flaw in one of its core processes reaches a lot of people.
F5 Networks is a leading vendor in the application delivery and security market, and BIG-IP is its flagship platform. Enterprises around the world use BIG-IP APM to enforce authentication, authorization, and secure access policies for web and network applications. Its OAuth capabilities are central to modern zero trust and federated identity architectures.
Technical information
CVE-2025-54854 is an out-of-bounds read (CWE-125) in the F5 BIG-IP APM module. It applies when APM is configured with OAuth access profiles as either Resource Server or Resource Client. If a virtual server has one of these profiles, certain undisclosed traffic patterns can make the apmd process terminate unexpectedly, which denies service to every active session that process manages.
The cause is insufficient validation of input data while APM processes OAuth protocol messages. A remote, unauthenticated attacker can send crafted traffic that makes the process read memory outside the bounds of allocated buffers. The apmd process then crashes, and authentication and access management operations are disrupted.
The issue is confined to the data plane. The control plane and management interfaces are not affected. F5 has not disclosed public exploit code or detailed triggering conditions, and it has not published vulnerable code snippets or technical diagrams.
Affected systems and versions
The following F5 BIG-IP versions are affected when APM OAuth access profiles (Resource Server or Resource Client) are attached to virtual servers:
- BIG-IP 17.1.0 through 17.1.2
- BIG-IP 17.5.0 through 17.5.1
- BIG-IP 16.1.0 through 16.1.6
A system is vulnerable only if the APM module is licensed and OAuth profiles are configured in Resource Server or Resource Client mode. Other configurations are not affected.
Vendor security history
F5 Networks has fixed memory safety and protocol parsing vulnerabilities in BIG-IP APM before. The company issues security notifications quarterly and maintains a transparent product lifecycle policy. Its patches generally arrive promptly, with detailed advisories and version-specific guidance. At the time of the advisory, no public exploit or patch was available for CVE-2025-54854.
