.jpg "F5 Fixes BIG-IP APM Zero-Day Enabling Unauthenticated RCE")
.jpg)
BIG-IP Access Policy Manager (APM) vulnerabilities have been patched by F5 as a result of zero-day attacks utilizing this vulnerability, which allows unauthenticated attackers to execute code on the system. As a result of this flaw, CVE-2026-94127 affects BIG-IP deployments with APM configured as an OAuth Authorization Server.
F5 disclosed the flaw on September 22 and assigned it a CVSS v3.1 score of 9.8.
There is a vulnerability resulting from a heap-based buffer overflow that can be triggered by specially crafted traffic sent to a vulnerable virtual server. For the affected configuration to be effective, it is necessary to associate an APM access policy with an OAuth Authorization Server profile.
The BIG-IP data plane can potentially be compromised without prior authentication due to malicious network traffic reaching it.
A F5 spokesperson confirmed that systems running in Appliance mode are also affected. As the vulnerable traffic is directed towards the virtual server handling OAuth requests, the BIG-IP management interface is not restricted by restrictions.
As of September 22nd, CISA added CVE-2026-94127 to its catalog of Known Exploited Vulnerabilities. This vulnerability does not affect deployments using APM solely as an OAuth Client or Resource Server.
Civilian agencies were given a deadline of September 25 to apply the mitigations, while F5 has provided engineering hotfixes for BIG-IP branches that have been affected.
F5 has not released any information on how many systems have been compromised or identified the threat actors behind the exploit. CISA's KEV entry, as well as the company's vulnerability record, do not include any information about which organizations were targeted for attack.
F5 Releases Mitigation and Detection Guidance
F5 has released engineering hotfixes for the affected BIG-IP branches, whereas an iRule has been created as a temporary mitigation for systems that cannot be patched immediately. F5 Support provides the iRule as a temporary measure, intended to provide protection until a permanent fix has been deployed. In order to ensure a successful deployment of the vendor hotfix, CISA has advised applying the temporary measure during forensic checks.
A number of indicators have been provided by F5 to assist in identifying possible exploitations. A repeated OAuth authentication failure, particularly one or more invalid token requests from the same IP in a short period of time, should be investigated further. An unpredicted increase in the total_failed OAuth statistic that correlates with other activity can serve as another indication.
The security team should review /var/log/audit for suspicious commands which occurred at the same time as unusual OAuth activity. TMM core files and unexpected TMM terminations with the SIGABRT signal may also be relevant, since F5 observed that the vulnerable process entered a loop and crashed while performing malicious activity. All of these signs alone do not indicate exploitation, so the timing and combination of events are crucial when analyzing the situation.
It is essential that organizations that have BIG-IP APM systems that are interconnected with the internet preserve relevant logs and forensic evidence before undertaking major changes to potentially compromised appliances. Patching the system closes the vulnerable code path, but does not prove whether an attacker gained access to the system prior to remediation.
At the time of this publication, F5 has not yet disclosed whether installing the hotfix removes access obtained in the past.
As well, the vendor has not publicly identified the attackers or disclosed the number of systems affected. Watchtowr researchers published a technical analysis on September 24 of CVE-2026-94127, which adds more information to this vulnerability as exploitation continues.
The affected BIG-IP APM configurations should be prioritized for F5 hotfix distribution, the recommended indicators of compromise should be reviewed, and systems should be investigated for signs of prior exploitation.
