CVE-2026-94127: F5 BIG-IP APM Zero-Day Under Active Exploitation
Summary
F5 has disclosed a critical actively exploited zero-day vulnerability, CVE-2026-94127, affecting BIG-IP Access Policy Manager (APM). The vulnerability is a heap-based buffer overflow that can allow an unauthenticated remote attacker to execute arbitrary code on vulnerable BIG-IP systems when APM is configured as an OAuth Authorization Server.
CVE-2026-94127 carries a CVSS v3.1 score of 9.8 (Critical) and affects specific supported BIG-IP APM 17.1.x, 17.5.x, and 21.1.0 deployments. Successful exploitation requires a BIG-IP virtual server on which both an APM access policy and an OAuth profile are configured, with APM operating in the OAuth Authorization Server role.
F5 confirmed that the vulnerability has already been exploited in the wild. CISA subsequently added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog , making rapid remediation particularly important for exposed BIG-IP environments.
The flaw affects the BIG-IP data plane rather than the management or control plane. Appliance mode does not provide protection against the issue, and systems running in Appliance mode remain vulnerable when the affected APM/OAuth configuration is present.
Background
F5 BIG-IP Access Policy Manager is an identity-aware access control component used to protect enterprise applications and resources. APM can integrate with authentication and federation technologies such as OAuth 2.0, OpenID Connect, and SAML, and can operate in several OAuth roles.
In the vulnerable configuration, BIG-IP APM operates as an OAuth Authorization Server. In this role, APM authenticates users or clients and issues OAuth access tokens that can subsequently be used to access protected resources.
F5 documentation shows that an APM OAuth Authorization Server can expose endpoints such as the authorization, token issuance, token revocation, and token introspection endpoints. Because these functions may be reachable through internet-facing virtual servers, vulnerabilities affecting request processing in this path can create a remotely accessible attack surface.
F5 disclosed CVE-2026-94127 on September 22, 2026 and simultaneously confirmed that exploitation had been observed. Emergency engineering hotfixes were released for the affected supported BIG-IP branches.
Vulnerability Details
| CVE ID | CVSS Score | Affected Product | Vulnerability Type | Exploitation Status |
|---|---|---|---|---|
| CVE-2026-94127 | 9.8 (Critical) - CVSS v3.1 | F5 BIG-IP Access Policy Manager (APM) | Heap-Based Buffer Overflow / Remote Code Execution | Actively Exploited / CISA KEV |
CVE-2026-94127 is categorized as CWE-122: Heap-Based Buffer Overflow. When a BIG-IP APM access policy and an OAuth profile are attached to the same virtual server, specially crafted malicious traffic can trigger unsafe memory handling within the affected processing path.
An attacker does not require valid credentials or user interaction to exploit the vulnerability. Successful exploitation can result in remote code execution on the BIG-IP system, potentially affecting the confidentiality, integrity, and availability of the appliance.
The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network-based exploitation, low attack complexity, no required privileges, no user interaction, and high impact to confidentiality, integrity, and availability.
Who Is Actually Vulnerable?
The presence of BIG-IP APM alone does not automatically mean a system is vulnerable. CVE-2026-94127 requires a specific configuration.
Vulnerable Configuration
A BIG-IP virtual server must have both an APM access policy and an OAuth profile configured, with APM operating as an OAuth Authorization Server.
According to F5, deployments using APM strictly as an OAuth Client or OAuth Resource Server, without OAuth Authorization Server profiles configured, are not affected by CVE-2026-94127.
Administrators should therefore evaluate both the installed BIG-IP version and the actual role/configuration of APM before determining exposure.
Affected Versions and Available Fixes
| BIG-IP APM Branch | Affected Versions | Fixed Hotfix |
|---|---|---|
| 21.1.x | 21.1.0 before the engineering hotfix | Hotfix-BIGIP-21.1.0.2.0.30.22-ENG |
| 17.5.x | 17.5.0 through 17.5.1 before the engineering hotfix | Hotfix-BIGIP-17.5.1.9.0.160.12-ENG |
| 17.1.x | 17.1.0 through 17.1.3 before the engineering hotfix | Hotfix-BIGIP-17.1.3.5.0.41.14-ENG |
F5 has not evaluated software releases that have reached End of Technical Support (EoTS). Organizations operating unsupported BIG-IP versions should not interpret their absence from the supported-version table as confirmation that they are safe.
How CVE-2026-94127 Works
The vulnerability exists in the request-processing path used when BIG-IP APM acts as an OAuth Authorization Server. Specially crafted network traffic can trigger a heap-based buffer overflow and lead to remote code execution.
Public technical information remains intentionally limited. F5 has not disclosed the exact vulnerable function, malicious request structure, memory corruption primitive, or exploit payload used in observed attacks.
This distinction is important for defenders: any publicly circulating exploit request claiming to reproduce CVE-2026-94127 should be independently validated against F5's advisory before being treated as authentic.
Important Technical Distinction
The vulnerability is a data-plane issue. F5 states that there is no direct control-plane exposure associated with CVE-2026-94127. However, unauthenticated code execution within a security appliance handling production application traffic still represents a critical compromise scenario.
Attack Methodology
Phase 1: Discovery of Internet-Reachable BIG-IP APM Infrastructure
An attacker first identifies an externally reachable BIG-IP virtual server providing APM-backed authentication or identity services.
The highest-risk systems are those operating APM as an OAuth Authorization Server and exposing the associated service endpoints to untrusted networks.
Phase 2: Identification of the Vulnerable OAuth Configuration
The attacker interacts with the exposed OAuth service and determines whether the BIG-IP instance is processing OAuth Authorization Server requests through an APM access policy.
F5 has not published a reliable unauthenticated fingerprint that definitively identifies vulnerable systems remotely, so defenders should validate exposure from the BIG-IP configuration itself rather than relying exclusively on external scanning.
Phase 3: Delivery of Malicious OAuth Traffic
The attacker sends specially crafted traffic to the vulnerable virtual server. The malformed request reaches the affected OAuth processing path within BIG-IP APM and can trigger the heap-based buffer overflow.
The exact exploit request and payload have not been publicly disclosed by F5.
Phase 4: Heap Memory Corruption
Processing of the malicious request results in unsafe heap memory handling. Exploitation of the memory corruption condition can alter program execution and ultimately provide attacker-controlled code execution.
Phase 5: Unauthenticated Remote Code Execution
Successful exploitation allows an attacker who has no valid BIG-IP credentials to execute code on the affected device.
F5's compromise-assessment guidance indicates that suspicious commands may appear in the BIG-IP audit log after anomalous OAuth activity, providing an important post-exploitation hunting opportunity.
Phase 6: Post-Exploitation Activity
Once code execution is obtained, an attacker may attempt to execute commands, establish persistence, access authentication-related data, manipulate appliance functionality, or use the compromised edge device as a foothold for further intrusion activity.
These are potential consequences of arbitrary code execution; F5 has not publicly attributed a specific malware family or complete post-exploitation toolset to the observed CVE-2026-94127 attacks at the time of writing.
MITRE ATT&CK Mapping
| Technique ID | Technique Name | Tactic | Reasoning |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access | Attackers exploit a remotely reachable BIG-IP APM OAuth service to gain unauthenticated code execution. |
| T1059 | Command and Scripting Interpreter | Execution | F5's compromise-assessment guidance directs defenders to search audit logs for suspicious commands following anomalous OAuth activity. |
The ATT&CK mapping above is based on publicly documented exploitation behavior. Additional persistence, credential-access, discovery, or command-and-control techniques should not be attributed to this campaign unless further evidence is published.
Visual Attack Flow
The attack path begins with an exposed BIG-IP APM virtual server configured as an OAuth Authorization Server. Specially crafted unauthenticated traffic reaches the vulnerable OAuth processing path, triggers the heap-based buffer overflow, and can provide remote code execution. Defenders may subsequently observe repeated OAuth authentication failures, suspicious commands, and TMM process instability.
Mitigation
- • Apply the appropriate F5 engineering hotfix immediately. Update affected 21.1.x, 17.5.x, and 17.1.x deployments using the applicable F5 hotfix for the installed branch.
- • Preserve forensic evidence before remediation where compromise is suspected. Collect relevant APM, audit, and system logs and preserve available TMM core files before rebooting or making major system changes.
- • Review /var/log/apm for repeated OAuth failures. Pay particular attention to bursts of invalid-token errors originating from the same source IP.
- • Review /var/log/audit for suspicious commands. Correlate command activity with the timestamps of anomalous OAuth failures.
- • Investigate TMM crashes and SIGABRT events. TMM core files are not inherently malicious, but events occurring alongside the other published indicators require further investigation.
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here.
