CVE-2025-54854
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.
Risk Assessment
An attacker could remotely crash the apmd process, potentially disrupting OAuth authentication and access to protected resources.
Recommendation
Update BIG-IP to a version containing the fix. Consider restricting exposure of virtual servers with the APM OAuth profile to trusted sources.
Other vulnerabilities in BIG-IP APM
See all- CVE-2026-94127CriticalActively exploited
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specially crafted traffic can lead to remote code execution (RCE). The vulnerability exists only when BIG-IP APM is configured as an OAuth Authorization Server; deployments using APM strictly as an OAuth Client/Resource Server are not affected.
- CVE-2026-40067High
A vulnerability in BIG-IP APM causes undisclosed traffic to terminate the apmd process when an APM access policy is configured on a virtual server.
- CVE-2025-61933Medium
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-out user. Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2025-61960High
When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Original NVD description (English source)
When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS