CVE-2026-94127: Critical F5 BIG-IP APM Zero-Day Exploited for Remote Code Execution

F5 has disclosed a critical zero-day vulnerability affecting BIG-IP Access Policy Manager (APM) that is already being exploited in the wild. Tracked as CVE-2026-94127, the flaw can allow an unauthenticated remote attacker to execute arbitrary code on vulnerable BIG-IP systems by sending specially crafted traffic to an affected OAuth configuration.

The vulnerability is a heap-based buffer overflow classified as CWE-122. F5 assigned it a CVSS v3.1 score of 9.8, while its CVSS v4.0 score is 9.3, reflecting a network-accessible attack path with low complexity, no privileges required, and no user interaction.

Exposure depends on configuration rather than simply having BIG-IP APM installed. A virtual server must have both an APM access policy and an OAuth profile configured. The vulnerable scenario involves APM functioning as an OAuth Authorization Server; deployments using APM only as an OAuth Client or Resource Server are not affected unless the vulnerable authorization-server configuration is also present.

Contact Sales

F5 published its advisory on September 22, 2026 after determining that attackers were already exploiting the vulnerability. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, requiring affected U.S. federal civilian agencies to remediate by September 25, 2026.

CVE-2026-94127 analysis

The vulnerability exists in the BIG-IP APM OAuth functionality and results from improper handling of memory when the system processes specially crafted network traffic. The resulting heap-based buffer overflow can corrupt memory and allow an unauthenticated attacker to execute arbitrary code on the affected device.

The most important details for CVE-2026-94127 concern where the vulnerable functionality operates. F5 identifies this as a data-plane issue, meaning malicious traffic reaches the vulnerable Traffic Management Microkernel (TMM) through an affected virtual server. There is no direct control-plane exposure associated with this vulnerability.

This distinction has practical defensive consequences. Restricting access to the BIG-IP management interface alone does not eliminate the attack surface because exploitation occurs through application traffic processed by the affected virtual server rather than through the administrative interface.

The vulnerability can be exploited remotely without authentication or user interaction. An attacker capable of reaching the affected virtual server can send specifically constructed traffic to the OAuth functionality, trigger memory corruption, and potentially gain remote code execution.

CVE-2026-94127 affects BIG-IP APM installations running the following supported release branches when the required vulnerable configuration is present:

• BIG-IP APM 21.1.0
• BIG-IP APM 17.5.0 through 17.5.1
• BIG-IP APM 17.1.0 through 17.1.3

Software releases that have reached End of Technical Support were not evaluated by F5 and therefore should not be assumed safe simply because they are absent from the affected-products table.

F5 also confirms that BIG-IP systems running in Appliance mode remain vulnerable when the affected APM configuration is present.

Products evaluated as unaffected include BIG-IP Next, BIG-IQ Centralized Management, F5 Distributed Cloud services, F5OS, NGINX products, F5 AI Gateway, and other BIG-IP modules outside the affected APM OAuth configuration.

The vulnerable configuration specifically combines an APM access policy with an OAuth profile on the same virtual server. BIG-IP APM supports operation as an OAuth Authorization Server, where it can issue authorization codes, access tokens, and refresh tokens after processing OAuth requests.

In the affected scenario, malicious traffic reaches the OAuth processing functionality and triggers the memory-corruption condition. A heap-based buffer overflow occurs when software writes data beyond the allocated boundary of a memory region on the heap. Such corruption can overwrite adjacent application data and, when successfully controlled, alter program execution.

F5 has not publicly released the exact malformed request or memory layout needed to exploit the vulnerability. That limitation is significant because attackers are already using the flaw despite the technical exploitation chain not being publicly documented in detail.

A confirmed public CVE-2026-94127 PoC was not identified in F5’s advisory or the two requested reports at publication time. No widely available exploit module was confirmed either. However, real-world exploitation demonstrates that working exploit capability already exists outside the vendor and security-research community.

F5 says it discovered the vulnerability internally, but the company has not publicly disclosed the exact date on which researchers first identified it or when the first malicious exploitation occurred. The issue was publicly disclosed on September 22, 2026.

The vendor has also not attributed the activity to a specific threat actor, state-sponsored group, ransomware operation, or commercial surveillance company. Details about the number of compromised systems, victim industries, geographic targeting, and attackers’ post-exploitation objectives remain undisclosed.

CISA’s KEV listing nevertheless confirms that exploitation is active rather than theoretical. CISA assesses the vulnerability as automatable and assigns it a total technical impact under its SSVC data. Known ransomware campaign use was listed as unknown at the time of publication.

Unlike vulnerabilities where defenders can search for a single malicious IP address or payload hash, the available CVE-2026-94127 IOCs are primarily behavioral. F5 recommends looking for a combination of repeated OAuth authentication failures, suspicious command activity, and subsequent abnormal TMM behavior.

One important sign is repeated invalid-token activity in:

/var/log/apm

F5 recommends investigating repeated log entries indicating that a UserInfo request failed because an access token was invalid. Ten or more related failures, particularly when originating from the same source IP in a short period, warrant additional analysis.

Administrators can also inspect global OAuth statistics with:

tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed

An unexplained increase in total_failed should be correlated with other evidence rather than treated as proof of exploitation by itself.

When abnormal OAuth activity is found, defenders should review:

/var/log/audit

for suspicious commands occurring around the same timestamps. Unexpected command execution shortly after bursts of failed OAuth requests can provide a stronger indication that exploitation may have progressed beyond probing.

F5 also recommends investigating TMM core files. In observed malicious behavior, TMM can enter a loop that eventually causes the SOD daemon to send a SIGABRT signal. A TMM crash or core file alone does not prove exploitation, because crashes can have legitimate causes. The combination and timing of OAuth failures, unusual commands, and TMM termination are what make the activity significant.

The risk is particularly high for internet-facing BIG-IP APM systems because the vulnerability requires neither credentials nor victim interaction. Edge security and access infrastructure is also attractive to attackers because successful compromise can place malicious code directly on systems positioned between external users and internal enterprise services.

CVE-2026-94127 Mitigation

F5 has released engineering hotfixes for the affected supported branches. Organizations should identify every BIG-IP APM virtual server with the vulnerable OAuth Authorization Server configuration and install the appropriate fix immediately.

The available hotfixes are:

• BIG-IP APM 21.1.0: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso
• BIG-IP APM 17.5.x: Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso
• BIG-IP APM 17.1.x: Hotfix-BIGIP-17.1.3.5.0.41.14-ENG.iso

These engineering hotfixes contain the security correction for the corresponding release branches.

Organizations should not base remediation solely on installed APM versions. They should also determine which virtual servers have both an APM access policy and an OAuth profile, because that configuration determines whether the vulnerable code path is exposed.

If immediate patching is not operationally possible, F5 provides an iRule-based temporary mitigation that can be applied to affected virtual servers. Customers must contact F5 Support to obtain the vendor-provided iRule.

CISA specifically recommends applying the iRule as a temporary measure while conducting proactive forensic triage, followed by installation of the final vendor hotfix as soon as possible. The temporary rule should therefore not be treated as a replacement for patching.

Before making significant changes to a system suspected of compromise, organizations should preserve logs and other forensic evidence. This is particularly important because replacing software, restarting services, or installing patches may alter volatile evidence useful for determining whether exploitation already occurred.

CVE-2026-94127 detection should begin by identifying affected virtual servers and determining which were reachable from untrusted networks before the hotfix or mitigation was installed.

To Detect CVE-2026-94127 exploitation or attempted exploitation, defenders should investigate:

• Repeated OAuth authentication failures in /var/log/apm
• Ten or more related invalid_token failures from the same source IP within a short period
• Unexpected increases in the total_failed OAuth statistic
• Suspicious command execution recorded in /var/log/audit
• Commands appearing shortly after abnormal OAuth requests
• Unexpected TMM crashes or core files
• TMM processes terminating with SIGABRT
• New or unexplained outbound connections from the BIG-IP appliance
• Unexpected processes or files appearing after suspicious OAuth activity
• Configuration changes without an associated administrator action
• Authentication or network activity inconsistent with the normal role of the affected BIG-IP system

No single behavior should automatically be interpreted as proof of compromise. In particular, OAuth authentication failures and TMM core files can occur during legitimate operations. F5 recommends evaluating the events together and paying attention to their frequency, source, and temporal relationship.

Security teams should also preserve upstream and downstream network telemetry, including firewall, IDS/IPS, NetFlow, DNS, SIEM, and authentication records. External evidence can help reconstruct activity if local logs are incomplete or if an attacker successfully executed commands on the appliance.

Systems exposed before remediation deserve retrospective investigation because patching only closes the vulnerable code path; it cannot establish whether an attacker successfully exploited the device earlier.

If evidence of compromise is discovered, organizations should begin their standard incident-response process and investigate access through the affected BIG-IP system, any configuration changes, credentials potentially accessible to the appliance, and internal services reachable from it.

Because edge devices frequently terminate or broker access to sensitive enterprise applications, responders should also determine whether an attacker used the compromised BIG-IP instance to pivot further into the environment.

CISA added the vulnerability to the KEV catalog on September 22, 2026, with a federal remediation deadline of September 25, 2026. This unusually short remediation window reflects the combination of confirmed active exploitation, unauthenticated remote access, low attack complexity, and potentially severe impact.

The immediate CVE-2026-94127 mitigation priority is therefore to preserve forensic evidence, apply the vendor-provided temporary iRule where necessary, install the applicable F5 engineering hotfix, and verify that every affected OAuth Authorization Server virtual server is protected.