CVE-2026-40067
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability in BIG-IP APM causes undisclosed traffic to terminate the apmd process when an APM access policy is configured on a virtual server.
Risk Assessment
Termination of the apmd process may disrupt APM services, leading to application unavailability and potential financial losses.
Recommendation
Immediately update to a patched version of BIG-IP or apply temporary mitigations if available.
Other vulnerabilities in BIG-IP APM
See all- CVE-2026-94127CriticalActively exploited
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specially crafted traffic can lead to remote code execution (RCE). The vulnerability exists only when BIG-IP APM is configured as an OAuth Authorization Server; deployments using APM strictly as an OAuth Client/Resource Server are not affected.
- CVE-2025-61933Medium
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-out user. Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2025-61960High
When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2025-54854High
When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.
Original NVD description (English source)
When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS