BIG-IP APM with an access policy + OAuth profile on a virtual server can be hit with specific malicious traffic to trigger a heap-based buffer overflow and unauthenticated RCE. Only affects APM configured as an OAuth Authorization Server. OAuth Client/Resource Server-only setups are not impacted. Upgrade to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG to mitigate.