What Happened
The F5 BIG-IP APM vulnerability is now confirmed and exploited. On 22 September 2026, F5 published an advisory for a critical vulnerability in its BIG-IP APM product and confirmed active exploitation in the wild. CERT-EU, the European Union's computer emergency response team, recommends taking appropriate actions as soon as possible.
This is not a theoretical issue. The vendor has confirmed that attackers are already using it. For MSPs, that changes the priority from patch when convenient to confirm exposure now.
BIG-IP APM is the access policy module in F5's BIG-IP platform. It handles remote access, application publishing, and access control, which means a flaw here can sit directly on the path between users and the systems they reach.
Timeline
The public record currently includes one confirmed date.
- 22 September 2026: F5 published an advisory addressing a critical vulnerability affecting BIG-IP APM and confirmed active exploitation in the wild.
Who Is Affected
Any MSP running F5 BIG-IP APM in its own environment should treat this as urgent. Any MSP that manages F5 BIG-IP APM for clients has the same concern, multiplied by every client deployment.
BIG-IP APM is commonly used for remote access VPN, portal access, and application authentication. That means the affected product is often exposed to the internet or at least positioned at a network boundary. An exploited flaw in that position can give an attacker a foothold inside the network.
No specific version is named in the public advisory summary we are working from, so assume any BIG-IP APM deployment could be affected until you confirm otherwise.
Technical Details: F5 BIG-IP APM Vulnerability
The technical details available from the sources are limited. F5 published an advisory on 22 September 2026 addressing a critical vulnerability affecting its BIG-IP APM product. The vendor confirmed active exploitation in the wild. CERT-EU recommends taking appropriate actions as soon as possible.
No CVE identifier, no affected version range, and no attack vector are included in the advisory summary. Treat the absence of those details as a reason to watch for updates, not as a reason to wait.
What to Do This Week
The vendor advisory is the authoritative source for patching and mitigation details. As those details land, here is the sequence that makes sense for an MSP.
- Inventory every F5 BIG-IP APM instance you operate or manage. Include client appliances, virtual editions, and anything in a lab or development environment.
- Check the F5 advisory and CERT-EU advisory for affected versions, patch availability, and mitigations. Bookmark both and check them daily until this is resolved.
- Apply the vendor fix as soon as it is available. Prioritize internet-facing instances and any appliance that handles remote access.
- If the vendor provides a mitigation that does not require a full patch, apply it immediately. Then plan the full fix for the next maintenance window.
- Review authentication logs and access logs for the affected appliances. Look for unexpected logins, new accounts, or changes to access policies.
- Restrict access to the BIG-IP management interface. Put it behind an allowlist, require a strong authentication method, and avoid exposing it to the internet.
- Watch for updated guidance from F5 and CERT-EU. The technical details are limited so far, and the response may change as more is known.
What to Tell Clients
We are tracking a critical vulnerability in F5 BIG-IP APM that the vendor has confirmed is being actively exploited. We are checking whether your environment includes this product and will let you know if any action is needed.
If your deployment is affected, we will schedule the required update as soon as possible. We are also reviewing access logs and tightening access to the appliance while we wait for the vendor's full guidance.
You do not need to do anything right now. We are handling the assessment, and we will come back to you with a clear next step if one is needed.
Frequently Asked Questions
What Is the F5 BIG-IP APM Vulnerability?
F5 published an advisory on 22 September 2026 for a critical vulnerability in its BIG-IP APM product. The vendor confirmed active exploitation in the wild. CERT-EU recommends taking appropriate actions as soon as possible. Specific technical details are limited so far.
Is the F5 BIG-IP APM Vulnerability Being Exploited?
Yes. F5 confirmed active exploitation in the wild in its advisory. That is why CERT-EU published a security advisory recommending prompt action.
Which Versions of F5 BIG-IP APM Are Affected?
The public advisory summary does not list specific affected versions. Until F5 publishes more detail, treat any BIG-IP APM deployment as potentially affected and check the vendor advisory regularly.
What Should MSPs Do About the F5 BIG-IP APM Vulnerability?
Inventory all BIG-IP APM instances, review the F5 and CERT-EU advisories, apply patches or mitigations as soon as they are available, and review access logs for signs of compromise. Restrict management access to the appliance while the response is underway.
What Should We Tell Clients About the F5 BIG-IP APM Vulnerability?
Tell clients you are aware of the vulnerability, checking whether their environment is affected, and will schedule any required update. Keep the message simple and avoid asking them to do technical work.
Sources
- 2026-013: Critical Vulnerability in F5 BIG-IP APMCert Eu · Official