Updated Date: 10/14/2026
APM Client Release Notes 7.2.7.3
This is a critical release - please see Overview of F5 Critical Releases for more information, and treat every release as though it closes a critical gap.
The following table summarizes the impact of Critical and High severity vulnerabilities in the data plane across the F5 product portfolio.
| Product Name | Data Plane | |
|---|---|---|
| Critical | High | |
| F5 Distributed Cloud Services | No | No |
| BIG-IP TMOS | Yes | Yes |
| BIG-IP Access Policy Manager (APM) Clients | No | Yes |
| BIG-IP SSL Orchestrator | Yes | Yes |
| F5OS - Appliance | Yes | Yes |
| F5OS - Chassis | Yes | Yes |
| BIG-IQ | Yes | Yes |
| F5 Insight | Yes | Yes |
| BIG-IP Next for Kubernetes | Yes | Yes |
| F5 BIG-IP Cloud-Native Network Functions (CNFs) | Yes | Yes |
| BIG-IP Next for Kubernetes (Host) | Yes | Yes |
| BIG-IP eBPF Observability (EOB) | No | No |
| BIG-IP Container Ingress Services (CIS) | No | No |
| Aspen Mesh | No | No |
| F5 NGINX Plus | No | Yes |
APM Clients allows to establish secure communications to applications and networks. It provides users with full access to IP-based applications, resources, and intranet files as if they were physically working on the office network for a variety of clients.
The APM Clients .iso package can be loaded onto BIG-IP APM where it can be customised to download individual client installers.
This release note contains information about the changes made for the current version only. Refer to the prior release note versions for additional information.
The Edge Client version 7.2.7.3 is now available on MyF5.com (under the APM Clients container). For download instructions, refer to the K000090258: Download F5 products from MyF5 article.
Notes:
-
Beginning with F5 BIG-IP APM Client 7.2.7.1, a redesigned Linux VPN client replaces the traditional Linux Web VPN client. For more information, refer to K000162241.
-
The application icons for Windows Edge Client, Windows Web Client, and macOS Web Client have been updated with F5 logos for both dark and light modes.
The apmclients-7273.2026.1004.1011-7784.0.iso supports the following clients and other components such as the CTU (Client Trouble Shooting Utility).
| BIG-IP Edge Client Windows | Mac F5 Access | Mac Edge Client | Linux | Linux Browser helper apps | MacOS Browser helper apps | Windows Browser helper apps |
|---|---|---|---|---|---|---|
| 7273.2026.1004.1011 | 7273.0.0.4 | 7273.2026.1004.1 | 7273.0.0.3 | 7273.2026.1004.1011 | 7273.2026.1004.1011 | 7273.2026.1004.1011 |
Important:
- F5 announced the discontinuation of 32-bit Linux support in the APM Edge Client Compatibility matrix. In the next major APM Clients release, F5 will remove 32-bit binaries from client ISO images. For more information, please refer to K000157971: End of technical support for BIG-IP APM network access, VPN Linux 32-bit client OS.
- Going forward, F5 Access for MacOS will be released along with APM Clients releases and introduces changes to deployment workflow and versioning. For more information on this change, refer to K000152992.
For a comprehensive list of documentation that is relevant to this release, refer to the following pages:
No new features in this release.
The following are the fixes in this release:
| Issue ID | Component | Description |
|---|---|---|
| 1961961-2 | Windows Edge Client | Fixed JavaScript issues during Captive Portal authentication. |
| 2251413-1 | macOS Edge Client | Fixed an issue where the Edge Client UI remained in the “Connecting” state after the VPN connection was established. |
| 2259373-1 | Windows Edge Client | Fixed Captive Portal authentication issues in Always Connected mode. |
| 2397713-1 | macOS Edge Client | Fixed an issue where macOS Edge Client failed to establish VPN after auto-upgrade in Always Connected mode. |
| 2456525-1 | macOS Edge Client | Fixed an issue where the Edge Client icon was not displayed in the macOS menu bar while disconnected. |
| 2493933-1 | Windows Edge Client | Fixed crashes during reconnect attempts. |
| 2504945-1 | Windows App Tunnel | Fixed an issue causing slow App Tunnel connections over SSH. |
| 2524873-1 | Windows Edge Client | Fixed an issue causing frequent disconnections after the VPN connection was established. |
| 2525249-1 | Windows Machine Tunnel | Fixed an issue where Machine Tunnel failed to connect when multiple client certificates were present on the device. |
| 2535101-1 | Windows Edge Client | Fixed the issue where VPN disconnection occurs during recurrent Endpoint checks when strict SNI check is enabled. |
Following are the Known Issues.
| ID Number | Description |
|---|---|
| 2225353 | The Windows Edge Client taskbar icon is not getting updated to the new F5 logo when the application is pinned to the taskbar. |
| 2390025 | PQC is not supported for control plane HTTPS traffic in Linux Web VPN client. |
| 2390029 | VPN connection fails intermittently in Ubuntu 26.04 when the recurring check is configured. |
| 2383045-1 | IPsec VPN connection fails to establish when multiple certificates with the same CN/SAN but different Issuer ID are installed on Windows. Workaround: - Remove certificates that share the same CN/SAN but have different Issuer IDs. - Use certificates with unique CN/SAN names to avoid conflicts. |
| 2251413 | On macOS Edge Client, the UI continues to display the status as “Connecting” even after the VPN connection is successfully established. Workaround: Disconnect and reconnect from Edge Client. |
| 2224925 | When the client machine has multiple valid certificates for client certificate inspection, the Windows Edge Client will prompt the user with a dialog box to select a certificate from the list of matching certificates each time a VPN session is initiated. |
| 2162537 | Microsoft’s Trident engine (Embedded Browser) does not support PQC MLKEM ciphers. As a result, any HTTPS requests initiated by Trident will not use PQC MLKEM ciphers during the TLS handshake. This affects the following scenarios: Edge Client: When configured to use the embedded browser for user authentication, all HTTPS requests initiated from the Trident engine will not support PQC ciphers. This limitation is limited to authentication (using the embedded browser). To overcome this limitation, system’s Default Web Browser can be configured for user authentication. Web VPN: Web VPN uses Trident to render the VPN connectivity UI. UI related HTML file requests (/vdesk/resource_all_info.eui, webtop_resource_inner.eui) and subsequent requests such as CSS or JS files and timeoutagent-i.php initiated by the Trident engine will not use PQC ciphers. Windows Pre-Logon: Similar to Edge Client, when Pre-Logon uses the embedded browser for user authentication, HTTPS requests from this engine will not support PQC ciphers. Note: These limitations do not affect the Machine Tunnel client. VPN tunnel establishment of all the Windows Clients is unaffected by the Trident limitation. |
| 1079621 | When the application is moved to the trash, the respective application F5 EPI or F5 VPN directory is getting deleted from the following path: /Applications/F5 Endpoint Inspector.app/Contents/Resources/ Whereas, the respective application specific (F5 EPI or F5 VPN) folder is not getting deleted from the following path: /Users/<username>/Library/Applications Support/F5 EPI The plist file of the respective application is not deleted from the following path: /Users/<username>/Library/Launchagents/ Workaround: If you are running MacOS Version 12.2 or later 1. Upgrade to the latest build and verify the applications are recent: /Applications/F5\ VPN.app /Applications/F5\ Endpoint\ Inspector.app 2. Delete the following LaunchAgents: ~/Library/LaunchAgents/com.f5.f5epihelper.plist ~/Library/LaunchAgents/com.f5.f5epihelper.plist 3. Delete the following python scripts: ~/Library/Application\ Support/F5\ VPN/uninstall.py ~/Library/Application\ Support/F5\ EPI/uninstall.py 4. Reboot the device to remove the Launch agents in memory. |
| 1082821 | When trying to establish a VPN connection using a browser, it does not work with TLS 1.3 on all versions of macOS. Workaround: Enable other versions of TLS to allow the browser to fallback to any other versions of TLS protocol. |
| 1082825 | When trying to establish a VPN connection using a browser, it does not work with TLS 1.3 on Linux. Workaround: Enable other versions of TLS to allow the browser to fallback to any other versions of TLS protocol. |
| 1084369 | Optimized tunnels are not supported on ARM64-based Windows 10 and Windows 11 systems. When Optimized tunnels are used, the tunnel connection fails without user notification. Workaround: In some cases, use a static app tunnel to establish a tunnel connection. |
| 1194381 | An intermittent issue is observed when Edge Client on Windows fails to reconnect if the LAN cable is unplugged when the system is asleep. Workaround 1: Add the Virtual Server FQDN to the stonewall exclusion list on BIG-IP. Workaround 2: The LAN cable should be unplugged from the Windows system prior to hibernation if the user does not want to continue with LAN connectivity after coming out of hibernation. Workaround 3: If step 1 is missed or skipped, and faces the Edge Client reconnect issue after coming out of hibernation then the Ethernet cable must be plugged into the Ethernet port on the Windows system. If there is no Ethernet cable, restart the Edge Client application. |
| 1239253 | Web F5 VPN will not be launched if certain versions of Ubuntu on ARM64 do not have the /lib/aarch64-linux-gnu/libpcre16.so.3 library installed. Workaround: Users who want to use web F5 VPN on certain versions of Ubuntu running on ARM64 which do not have /lib/aarch64-linux-gnu/libpcre16.so.3 should install libpcre16-3 using one of the following commands. sudo apt install libpcre16-3 or sudo apt-get install libpcre16-3 |
| 1295133 | Edge Client users are prompted to install the Endpoint Inspection (EPI) helper applications on macOS 13.3. Workaround: Preinstalling the latest EPI helper application would resolve the issue. For more information on the deployment process, refer to the Install the latest Edge Client on MacOS end devices section of the K000133476 article. For more details on the user experience changes, refer to the K000133622 article. |
| 1324053-1 | Users experience a one-time issue on Windows and MacOS as Edge Client configuration settings which were defined in the client.f5c are overwritten with the settings defined in the config.f5c when the auto-upgrade is enabled. This issue would not be seen when users upgrade from APM Clients 7.2.4.3 version to the future versions. Workaround: Administrators can define the desired configuration, especially the APM virtual server list in the config.f5c before the upgrade so that the Edge Client Installer copies the settings to the client.f5c file. Generally, the config.f5c file is available in the following directory path: Windows: C:\ProgramData\F5 Networks\Secure Access Client or C:\Program Files (x86)\F5 VPN MacOS: /Library/Application Support/F5Networks |
| 1581041 | The Show IP configuration and Show routing table buttons do not work for the F5 VPN window on the Mac Platform after the QT upgrade of APM clients. You can use the following command line tools to view the network configurations: /sbin/ifconfig /usr/sbin/netstat -rn /usr/sbin/scutil –dns |
| 1615801 | If the VPN connection is made from Windows 11 machines with WebVPN or Edge Client with Default Browser Authentication enabled, BIG-IP shows the wrong session.client.platform value. |
| 1628533-1 | Windows Logon Credentials feature does not work in Windows 11 24H2. Users cannot connect to Edge Client automatically as the prompt is displayed to specify the credentials. |
| 1678473 | Auto-upgrades of Windows Clients (Web EPI, Web VPN, and Edge Client) without Component Installer service fails. Workaround: 1) Re-install the Windows Clients (or) 2) Upgrade to 7248 GA build (apmclients-7248.2024.910.609-6452.0.iso) before upgrading to 725x or later. |
| 1697301 | On a Windows 10 machine, unable to establish VPN Connection with EdgeClient, WebVPN, Machine Tunnel, and Custom Dialer using TLS1.3. Workaround: 1. Upgrade Windows 10 to Windows 11 or 2. Establish a VPN connection with TLS1.2 |