F5's BIG-IP APM Heap Overflow Puts Remote Code Execution Behind an OAuth Profile

TL;DR

• BIG-IP APM is the access policy module F5 adds to its BIG-IP platform, the component a company runs at the edge of its network to check who a user is before a request reaches an application.
• F5 published CVE-2026-94127 on 22 September 2026 and rates it Critical at 9.8 under CVSS v3.1 and 9.3 under v4.0; it is a heap-based buffer overflow that lets an attacker run code with no credentials.
• One virtual server carries the whole exposure: it needs both an APM access policy and an OAuth Authorization Server profile, and deployments that use APM only as an OAuth client or resource server are outside the affected set.
• The vulnerable branches are 21.1.0, 17.5.0 through 17.5.1 and 17.1.0 through 17.1.3, and F5 ships the fix as an engineering hotfix on each branch.
• The flaw lives in the data plane, and a system in Appliance mode is vulnerable too; there is no control plane exposure, so the request path is the attack path.
• F5 lists three indicators: repeated OAuth failures, suspicious commands logged soon after, and a TMM SIGABRT raised when the traffic microkernel enters a loop.
• F5's interim iRule holds the traffic pattern down while the hotfix is scheduled, and CISA asks for forensic triage before the final patch goes on.
• CISA added the flaw to the Known Exploited Vulnerabilities catalog on the day of publication with a due date of 25 September, and F5 states that it has learned the vulnerability has been exploited.

One virtual server carries the whole exposure

F5's advisory states the trigger plainly: "When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE)." The condition narrows further in the same paragraph, because the flaw appears only where APM acts as the OAuth Authorization Server: "This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server."

The vendor then removes the ambiguity that usually surrounds an exploit condition. "Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability." A team that knows which role its APM profile plays therefore knows, in one look, whether it is in the affected population.

That population is smaller than the installed base and larger than a curiosity. APM configured as an authorization server is the pattern an organisation reaches for when it wants its own gateway to issue tokens to internal applications, which keeps application logins inside the corporate perimeter and inside the identity system the security team already audits. On the network, the result is one virtual server answering requests from the internet with an OAuth endpoint attached to it, and on that endpoint sits a heap-based buffer overflow.

F5 rates the flaw Critical at 9.8 under CVSS v3.1 and 9.3 under v4.0, classifies it as CWE-122 and tracks it under product development ID 2524777. Both scores describe the same reach: network access, no privileges, no user interaction. Rapid7 summarised the exposure the same way, noting that the flaw is not present in a default configuration and that exploitation requires a virtual server with both an APM access policy and an OAuth profile configured.

Why Appliance mode keeps the request path in the data plane

The impact statement is where this advisory earns its attention, because it describes a flaw that lives in the request path itself. "This vulnerability allows an unauthenticated attacker to perform RCE. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure."

Appliance mode exists to close the underlying operating system to administrators and to leave a hardened appliance that does one job. It does nothing about a defect that the traffic-processing microkernel reaches on its own. A team that has locked down management access, removed shell accounts and restricted the management interface to an operations network has genuinely improved its position against most appliance attacks, and has changed nothing about this one, because the request arrives on the same listener that legitimate application traffic uses.

Rapid7 drew the operational conclusion: "Because affected BIG-IP systems may process traffic at an organization's network edge, organizations using this configuration should prioritize remediation." An edge identity gateway is by definition reachable from untrusted networks, so exposure is a given, and the question a team has to answer is whether one virtual server carries both profiles at once.

Two records confirm that the question is live rather than theoretical. F5's advisory carries the notice that the company has learned the vulnerability has been exploited, and New York State's advisory for the same issue states that F5 has confirmed exploitation in the wild. Neither record names a victim, which is the normal shape of a vendor confirmation and the reason an asset query is worth more than a waiting posture.

The three indicators F5 asks defenders to look for

Detection guidance in the advisory is specific enough to work with, and it is the part a defender can act on today. F5 describes the shape of an attempt in one sentence: "multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT." The advisory then sets the bar for a response: "Three indicators observed close in time to one another should be considered a reason to investigate further."

The first indicator is OAuth failure noise in the APM log. A single failure message is routine on a busy gateway; the signal is repetition, and the advisory puts a number on it: sustained repetition of ten or more entries in one log deserves review, particularly when every entry comes from a single IP address. The failing line names an invalid token and the source that asked for user information, which makes the log easy to search.

The second indicator is command activity in the audit log shortly after those failures, which is where a read primitive turns into an operator on the box. The third is a TMM core file, produced when the traffic microkernel enters a loop and the state daemon aborts it; the advisory's own wording is "We have observed TMM enters a loop, which causes the SOD daemon to send a SIGABRT." F5 also points administrators at the global OAuth statistics counters, where an unexplained rise in the failed total is the number to chase.

Read as a sequence, the three indicators form a timeline that a defender can reconstruct after the fact and monitor for in advance. The OAuth failures come first and repeat, the commands follow close behind, and the core file closes the sequence. Each one alone is ordinary noise on a busy gateway; the value is in the ordering, and the ordering is what the vendor published.

The iRule holds the traffic while the hotfix is scheduled

The remediation path has one detail worth reading twice, because it changes how the work is planned. F5 is shipping the fix as an engineering hotfix on each affected branch. Version 21.1.0 moves to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, versions 17.5.0 through 17.5.1 move to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, and versions 17.1.0 through 17.1.3 move to Hotfix-BIGIP 17.1.3.5.0.41.14-ENG. A hotfix is a maintenance event with a maintenance window attached, and on a load-balanced pair that means a sequence rather than a task.

Where the upgrade cannot happen at once, F5 provides an iRule that restricts the malicious traffic pattern on the affected virtual server, obtained through a support case. CISA's guidance is explicit about the order of operations: "For temporary mitigation to allow for proactive forensic triage, apply the vendor-provided iRule." The sequence in the KEV entry is deliberate. Triage comes first because a log read after a patch tells you nothing about what arrived before it, and the patch follows because an iRule filters a known pattern while the underlying defect remains.

That defect was found inside the vendor. The advisory's acknowledgement states that the issue was discovered internally by F5, which places it in the smaller category of vendor-originated findings. It also means the public record is the vendor's own, and no third-party proof of concept was confirmed when the flaw entered the federal catalog on 22 September 2026.

Where the patch clock meets the forensic triage

The federal record adds a clock. CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities catalog on 22 September 2026 with a due date of 25 September 2026, marks the case as requiring forensic triage under BOD 26-04, and leaves the ransomware association as unknown. Rapid7 recorded the same entry with the detail that matters to a private-sector reader: "As of September 22, 2026, CVE-2026-94127 has been added to the CISA KEV while a publicly available proof of concept was not confirmed."

Entry into that catalog is driven by observed exploitation and reaches organisations that never see the vendor's timeline. For a company that runs its own gateway, the sequence follows the same order the vendor and the agency both describe. First comes the asset query: which virtual servers carry both an APM access policy and an OAuth authorization-server profile, and which of those answer requests from outside. Then comes detection, built on the OAuth failure counters and the audit log around their timestamps. Then comes containment with the iRule, then the hotfix on every node of the affected branch, then the review that reads the logs from before the change.

Two habits carry over from the rest of exposure management. The first is treating the exposed configuration as an inventory fact, so the question can be answered in an afternoon, well before any incident. The second is keeping a short list of internet-facing management and identity services with an owner and a review date, which is the discipline behind our own infrastructure monitoring and alerting work. A flaw with a published indicator sequence is one where preparation converts directly into a shorter window between the first failed token and the first informed decision; the Netics homepage lists the services where that preparation gets built.

Sources

Source: BIG-IP APM vulnerability CVE-2026-94127, article K000162605 — my.f5.com/manage/s/article/K000162605, F5, published 22 September 2026, updated 23 September 2026, retrieved 2026-10-08 (the OAuth authorization-server condition for the remote code execution path, the exclusion of OAuth client and resource server deployments, the unauthenticated remote code execution impact, the vulnerability of a system in Appliance mode, the data plane scope with no control plane exposure, the statement that F5 has learned the vulnerability has been exploited, the affected branches 21.1.0 and 17.5.0-17.5.1 and 17.1.0-17.1.3, the engineering hotfixes Hotfix-BIGIP-21.1.0.2.0.30.22-ENG and Hotfix-BIGIP-17.5.1.9.0.160.12-ENG and Hotfix-BIGIP 17.1.3.5.0.41.14-ENG, the CVSS v3.1 9.8 and v4.0 9.3 ratings on the APM OAuth component, the CWE-122 classification, product development ID 2524777, the iRule mitigation obtained from F5 Support, the three indicators of compromise with the repetition threshold of ten or more invalid token entries in one log from a single IP, the global OAuth statistics counters, the TMM loop that causes the state daemon to send the SIGABRT, and the acknowledgement that the issue was discovered internally by F5). Source: CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM — rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm/, Rapid7, published 23 September 2026, retrieved 2026-10-08 (the advisory date of 22 September 2026, the CVSS v3.1 score of 9.8, the heap-based buffer overflow classification, the non-default exposure requiring an APM access policy and an OAuth profile on one virtual server, the data plane scope, Appliance mode, the fixed hotfix versions, the edge placement that warrants prioritised remediation, and the KEV addition of 22 September 2026 with no public proof of concept confirmed). Source: Known Exploited Vulnerabilities Catalog entry for CVE-2026-94127 — cisa.gov/known-exploited-vulnerabilities-catalog, CISA, added 22 September 2026, due 25 September 2026, retrieved 2026-10-08 (the heap-based buffer overflow description with an access policy and an OAuth profile on a virtual server, CWE-122, the unknown ransomware association, forensic triage required under BOD 26-04, and the instruction to apply the vendor iRule for temporary mitigation before installing the final patch). Source: A Vulnerability in F5 BIG-IP Access Policy Manager Could Allow for Remote Code Execution, advisory 2026-098 — its.ny.gov/2026-098, New York State Office of Information Technology Services, issued 22 September 2026, retrieved 2026-10-08 (the confirmation that F5 has confirmed exploitation in the wild, the affected APM module versions, and the Initial Access technique mapping to exploit public-facing application).

Source: F5's security advisory K000162605 — my.f5.com, 22 September 2026; Rapid7's analysis of the advisory — rapid7.com, 23 September 2026; CISA's Known Exploited Vulnerabilities entry — cisa.gov, added 22 September 2026; New York State ITS advisory 2026-098 — its.ny.gov, 22 September 2026. All retrieved 2026-10-08. Figures: the vulnerable-versions table capture from my.f5.com and page one of F5's BIG-IP Access Policy Manager product overview from f5.com, plus three Netics editorial diagrams rendered from the same sources.