CVE-2026-40067: BIG-IP APM Vulnerability
Published May 13, 2026
·Updated
When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
5 affected components
F5 Networks BIG-IP APM
F5 BIG-IP Access Policy Manager>=16.1.0<=16.1.6
F5 BIG-IP Access Policy Manager>=17.1.0<=17.1.3
F5 BIG-IP Access Policy Manager>=17.5.0<=17.5.1
F5 BIG-IP Access Policy Manager=21.0.0
Event History
May 13, 2026
CVE Published
via MITRE·02:12 PM
Data Sourced
via MITRE·02:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-40067?
CVE-2026-40067 has a severity rating of 8.7, categorized as high.
2
How do I fix CVE-2026-40067?
To remediate CVE-2026-40067, users should upgrade to a patched version of F5 Networks BIG-IP APM that addresses this vulnerability.
3
What impact does CVE-2026-40067 have on my system?
CVE-2026-40067 can cause the apmd process to terminate, potentially disrupting access policies configured on virtual servers.
4
Is my version of F5 Networks BIG-IP APM vulnerable to CVE-2026-40067?
Versions of F5 Networks BIG-IP APM that have not reached End of Technical Support (EoTS) may be susceptible to CVE-2026-40067.
5
When was CVE-2026-40067 published?
CVE-2026-40067 was published on May 13, 2026.