CVE-2016-3687: Open redirect vulnerability in F5 BIG-IP APM 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6 and Edge...

Security readout for executives and security teams

This flaw affects F5 BIG-IP APM and Edge Gateway deployments using multi-domain SSO. It can let a remote attacker redirect a user from a legitimate access portal to an arbitrary website, creating a credible phishing path. The source bundle does not show direct system compromise or active exploitation. Exposure is likely limited to affected F5 access products with multi-domain SSO enabled and user-facing authentication flows. Internet-facing access portals increase phishing usefulness. The bundle’s affected metadata is incomplete, so confirm against F5 guidance. Prioritize remediation for internet-facing authentication portals because this can erode user trust and enable credential phishing. It is not described as direct takeover, but exposed SSO infrastructure is high-value and should not carry known redirect flaws. Mitigation focus: Review the F5 advisory for exact fixed releases and upgrade paths.; Update affected BIG-IP APM 11.6.x systems to 11.6.0 HF6 or later if applicable.; For Edge Gateway 11.2.1, follow F5’s product-specific guidance..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.