F5 BIG-IP APM has a critical flaw that attackers are exploiting
Attackers are actively using a serious weakness in F5 BIG-IP APM, a device that controls who can log in to a company's internal systems. If left unpatched, an outsider could potentially get into systems they should not reach.
| Severity | CriticalVulnerability |
|---|---|
| Being exploited? | ReportedBy CERT-EU, not officially confirmed yet |
| Fix available? | UnclearNo fixed version published in the sources yet |
| How sure is this? | Official sourceBacked by an official source |
What happened
A critical vulnerability in F5 BIG-IP APM (Access Policy Manager) was disclosed in an F5 advisory published 22 September 2026, and F5 has confirmed active exploitation in the wild.
Are you affected?
You are affected if you run F5 BIG-IP APM in your environment; the material does not list specific versions or configurations.
F5 BIG-IP APM (exact versions not stated in the provided material)
What to do
- Check F5's 22 September 2026 advisory for affected versions and the fix for your BIG-IP APM
- Apply the vendor patch or recommended mitigation as soon as possible
- Review BIG-IP APM access logs for signs of unusual or unauthorised activity
Timeline
- 25 Oct 2026, 15:20 UTCPicked up by Zero Radar
- 25 Oct 2026, 15:20 UTCPublicly disclosed
- 25 Oct 2026, 15:20 UTCReported by CERT-EU · CERT-EU
Sources 1 report, oldest first
Official vendor, government CERT or advisory database
- 2026-013: Critical Vulnerability in F5 BIG-IP APMCERT-EU · 25 Oct 2026, 15:20 UTC
Technical details
- ID
- ZR-b8e3b9a5
- Disclosed
- 25 Oct 2026, 15:20 UTC
- On Zero Radar
- 25 Oct 2026, 15:20 UTC
- Last change
- 25 Oct 2026, 15:20 UTC
The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works