On September 22, 2026, F5 disclosed a critical remote code execution vulnerability in its BIG-IP Access Policy Manager (APM) that was already being exploited in the wild. Tracked as CVE-2026-94127, the flaw carries a CVSS score of 9.8 (Critical) under v3.1 and 9.3 under v4.0. CISA immediately added it to the Known Exploited Vulnerabilities (KEV) catalog, giving U.S. federal agencies until September 25 to remediate.
This is not a theoretical edge-case bug. It is a data-plane heap-based buffer overflow (CWE-122) that lets an unauthenticated attacker send specially crafted traffic to a vulnerable virtual server and achieve full remote code execution.
What Makes the Configuration Dangerous
The vulnerability only triggers under a specific—and increasingly common—setup:
- A BIG-IP APM access policy and
- An OAuth profile configured on the same virtual server
- Where BIG-IP APM is acting as an OAuth Authorization Server
Deployments that use APM strictly as an OAuth Client or Resource Server (without authorization-server profiles) are not affected. Appliance mode systems remain fully vulnerable. There is no control-plane exposure; the attack hits the data plane directly.
In short: if your BIG-IP is issuing OAuth tokens while enforcing an access policy on the same VIP, you are in the blast radius.
Affected Versions and Fixes
F5 released engineering hotfixes the same day it disclosed the issue:
| Branch | Affected Versions | Fixed Hotfix |
|---|---|---|
| 21.1 | 21.1.0 before the hotfix | Hotfix-BIGIP-21.1.0.2.0.30.22-ENG |
| 17.5 | 17.5.0 through 17.5.1 before the hotfix | Hotfix-BIGIP-17.5.1.9.0.160.12-ENG |
| 17.1 | 17.1.0 through 17.1.3 before the hotfix | Hotfix-BIGIP-17.1.3.5.0.41.14-ENG |
Software that has reached End of Technical Support was not evaluated. No other F5 products are reported as vulnerable.
Why This One Hurts
Unauthenticated RCE on internet-facing access gateways is a classic high-value target. BIG-IP APM sits at the edge of many enterprise and government networks, handling authentication, authorization, and increasingly OAuth/OIDC flows for modern applications and APIs. Compromising one of these devices can give an attacker a foothold inside the network, the ability to issue forged tokens, or a launchpad for lateral movement.
F5 confirmed the vulnerability was already under active exploitation before public disclosure. Shadowserver and other scanners have identified tens of thousands of internet-exposed BIG-IP APM instances, many of which may match the vulnerable configuration.
Temporary Mitigation and Detection
If you cannot apply the hotfix immediately, F5 Support can provide an iRule that mitigates the issue when applied to the affected virtual server. Contact F5 Support to obtain it.
For detection, F5 and partners recommend looking for a combination of signals rather than any single indicator:
- Repeated OAuth authentication failures (especially UserInfo requests) in /var/log/apm, particularly bursts of ten or more from the same source IP in a short window.
- Elevated total_failed counters visible via tmctl global_oauth_stat.
- Suspicious or unexpected commands appearing in /var/log/audit around the same timestamps.
- A subsequent TMM SIGABRT or core file.
Any one of these can occur for benign reasons; the cluster of them in sequence is what warrants investigation.
Recommended Actions
- Inventory every BIG-IP APM virtual server that has both an access policy and an OAuth profile (Authorization Server role).
- Apply the appropriate hotfix as soon as change windows allow. Verify with tmsh show sys version after reboot.
- Deploy the temporary iRule if patching must be delayed.
- Hunt for the IoC pattern described above, especially if the device was internet-exposed during the window of exploitation.
- Review administrative accounts, access policies, and any newly issued OAuth tokens for anomalies.
Closing Thought
CVE-2026-94127 is a reminder that modern identity protocols layered on top of traditional access gateways create new attack surfaces. When the gateway itself becomes the authorization server, a single memory-safety issue can bypass every authentication check that follows.
Patch promptly. Assume exposure until proven otherwise. And treat any system that issues tokens as high-value infrastructure—because attackers already do.
For the official advisory, see F5 Knowledge Article K000162605 and the CVE record at cve.org. Stay safe out there.
Comments
Post a Comment