F5 patches exploited BIG-IP APM flaw as U.S. agencies face Friday deadline

F5 has released security updates for a critical BIG-IP APM flaw that it says attackers have exploited to run code remotely. BIG-IP APM manages access to organizational networks and applications. The vulnerability affects configurations that use an APM access policy and an OAuth profile on a virtual server; deployments used strictly as OAuth clients or resource servers without authorization server profiles are unaffected. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its list of known exploited vulnerabilities on Tuesday and ordered federal agencies to secure their networks by Friday. F5 also provided a mitigation through its support service for administrators who cannot immediately install the updates.