Attackers are running code on BIG-IP APM boxes configured as OAuth authorization servers
F5 disclosed CVE-2026-94127 on September 22 with hotfixes and evidence of exploitation. It is a data plane heap overflow, so a locked-down management interface still leaves the system exploitable, and federal agencies had until September 25.
The Watch · Security desk
What happened
- F5 said on September 22 that CVE-2026-94127 is being exploited to run code on BIG-IP Access Policy Manager systems without any login, and rated the heap-based buffer overflow 9.8 on CVSS v3.1.
- Only deployments where APM acts as an OAuth authorization server issuing access tokens are affected, with the access policy and the authorization server profile bound to the same virtual server.
- Affected builds are 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3, each with an engineering hotfix, and F5 says no other product is vulnerable.
- CISA listed the CVE in its Known Exploited Vulnerabilities catalog the same day and set a three-day remediation clock for federal agencies under BOD 26-04, expiring September 25.
Why it matters
- What it limits constraint Teams that cannot take the hotfix in a change window have one fallback, an iRule that F5 hands out only through a support ticket, so containment waits on F5 support's response time.
- Who's exposed exposure Anyone who closed the March KEV item on APM by moving to 17.1.3 or 17.5.1.3 is still exploitable, because both builds sit inside the new affected range.
- What doesn't add up contradiction A defender scoping the fleet from CISA's or CERT-EU's wording will pull in every virtual server with an access policy and an OAuth profile, a wider set than the authorization-server-only condition F5 now states.
- What it sets up precedent Four of the eight actively exploited F5 flaws CISA has flagged since November 2021 were also used in ransomware attacks, so APM operators should plan for this exploit to spread beyond whoever used it first.
Next story · Security · 2d ago
Exploited Cisco email gateway flaw lets a crafted attachment run commands as rootConfirmed5 publishers
The traffic that triggers CVE-2026-94127 goes to the virtual server that already receives OAuth traffic, the same BIG-IP address legitimate clients use to get tokens, and specific malicious requests to it lead to code execution [17]. "The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure," F5 said in its advisory [7]. Locking down the management interface does not protect the system [8].
CISA told agencies to apply F5's iRule first "to allow for proactive forensic triage," then to "install the final vendor patch as soon as possible" [23]. Customers get the iRule by opening a ticket with F5 support [10].
F5 updated its CVE record at 00:45 UTC on September 23 to say the flaw is present only in the authorization server role [18]. CISA's KEV entry and an advisory from CERT-EU were published before that change and describe the condition more broadly, as an access policy and an OAuth profile on a virtual server [18]. The narrowing arrived with less than two days left on the clock CISA set [29]. F5 did not evaluate builds past End of Technical Support [27].
Shadowserver tracks more than 14,700 IP addresses carrying BIG-IP APM fingerprints, and it did not say how many are patched or are honeypots [19]. "Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability," F5 said [4]. The 14,700 is the outer bound of the population to triage, and the query that narrows it is whether an OAuth authorization server profile is bound to an access profile on a virtual server [2].
The indicators F5 published are cheap to run. The combination that should send a human to the box is repeated OAuth authentication failures, then suspicious commands, then a TMM SIGABRT shortly after [12]. In /var/log/apm, look for failed UserInfo requests with the error description "The access token is invalid.", especially 10 or more from a single IP address in a short time [13]. Check total_failed in the output of tmctl global_oauth_stat for an unexplained rise, and read /var/log/audit around the timestamps of those failures [14]. TMM core files on their own are not a sign, though F5 has seen TMM enter a loop and the SOD daemon send a SIGABRT [15]. CERT-EU's order of operations is preserve forensic evidence, apply the hotfix, check for signs of compromise, and start incident response if any turn up [24].
F5 said it discovered the defect internally [25]. Its CVE record and CISA's KEV entry do not name the attackers or say how many systems were hit [20]. Separately, F5 disclosed in October 2025 that state-sponsored hackers had breached its systems in August 2025 and stolen BIG-IP security source code and vulnerability information [21].
What to watch
- Whether CISA and CERT-EU revise their advisories to match F5's authorization-server-only condition, and how many defenders scoped their fleet from the older wording.
- Whether any actor gets named, and whether this exploit turns up in ransomware intrusions as four earlier F5 KEV entries did.
- Whether F5 states what the hotfix does to access an attacker established before it was installed.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption40
- Hype gap+10
- Incentives30
- Confidence75
Perspective Coverage
6 publishers- Builder
- Builder 19%
- Operator
- Operator 64%
- Investor
- Investor 17%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says.
- [2]
CVE-2026-94127 affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications.
- [3]
"We have learned that this vulnerability has been exploited," F5 warned in a security advisory published on Tuesday.
- [4]
"Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability," F5 said.
- [5]
CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 22 and gave federal civilian agencies until September 25 to apply F5's mitigations, under a directive CISA issued in June.
- [6]
CISA added CVE-2026-94127 to its KEV list and urged federal agencies to patch it within three days, as mandated by BOD 26-04.
- [7]
"The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure," F5 notes in its advisory.
- [8]
Because the malicious traffic goes to the virtual server itself, limiting access to the BIG-IP management interface does not protect against this flaw, and BIG-IP systems in Appliance mode are also vulnerable.
- [9]
F5 disclosed CVE-2026-94127 in an advisory on September 22 and has released engineering hotfixes.
- [10]
When the hotfix cannot be installed immediately, F5 offers an iRule mitigation for the affected virtual server, which customers get by opening a ticket with F5 support.
- [11]
The flaw is a heap-based buffer overflow. F5 rates it 9.8 out of 10 on CVSS v3.1 and 9.3 on CVSS v4.0.
- [12]
The combination that should lead to a human review of the system is repeated OAuth authentication failures, followed by suspicious commands, followed by a TMM SIGABRT shortly after.
- [13]
APM log indicator: repeated failed UserInfo requests in /var/log/apm with the error description "The access token is invalid," especially 10 or more requests from a single IP address within a short time.
- [14]
OAuth counter indicator: an unexplained rise in total_failed when running tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed; audit log indicator: suspicious commands in /var/log/audit around the times of those failures.
- [15]
TMM core files are not a sign on their own but are worth investigating; F5 has seen TMM enter a loop, causing the SOD daemon to send a SIGABRT.
- [16]
BIG-IP APM versions 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3 are vulnerable, F5 has released hotfixes, and no other products are vulnerable.
- [17]
The vulnerable setup has an APM access policy and an OAuth authorization server profile on the same virtual server, which hosts the BIG-IP address that receives the OAuth traffic; specific malicious traffic sent to that virtual server can lead to remote code execution.
- [18]
F5 updated its CVE record at 00:45 UTC on September 23 to say the flaw is present only in the authorization server role; CISA's KEV entry and an advisory from CERT-EU were published before that change and both describe the condition more broadly, as an access policy and an OAuth profile on a virtual server.
- [19]
Shadowserver currently tracks over 14,700 IP addresses with BIG-IP APM fingerprints, with no information on how many have already been patched or are honeypots.
- [20]
F5's CVE record and CISA's KEV entry do not say how many systems were attacked, who the attackers are, or which organizations were targeted.
- [21]
F5 disclosed in October 2025 that state-sponsored hackers breached its systems in August 2025 and stole undisclosed BIG-IP security source code and vulnerabilities.
- [22]
Another APM flaw, CVE-2025-53521, was added to CISA's KEV catalog in March; its fixes for the 17.1 and 17.5 branches, 17.1.3 and 17.5.1.3, fall inside the new affected ranges, so a system updated to either build still needs the new hotfix if APM acts as an OAuth authorization server.
- [23]
CISA told agencies to apply the iRule first "to allow for proactive forensic triage," and then to "install the final vendor patch as soon as possible."
- [24]
CERT-EU advises preserving forensic evidence first, applying the hotfix, checking for signs of compromise, and starting incident response if any are found.
- [25]
F5 says it discovered the security defect internally.
- [26]
Since November 2021, CISA has flagged eight actively exploited F5 vulnerabilities, four of which have also been abused in ransomware attacks.
- [27]
F5 did not evaluate versions that have reached End of Technical Support, so their status is unknown rather than safe.
- [28]
F5 provides services to more than 23,000 customers worldwide, including 48 of the Fortune 50 companies and 80% of the Fortune Global 500.
- [29]
F5's narrowed CVE record, published at 00:45 UTC on September 23, landed 1 day and about 23 hours before the start of CISA's September 25 deadline, i.e. less than two days of the remediation window remained.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comF5 patches BIG-IP APM zero-day flaw exploited in RCE attacks
1 article · September 23, 2026
- blog.rapid7.comCVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM
1 article · September 23, 2026
- scworld.comF5 patches critical zero-day flaw exploited in BIG-IP APM
1 article · September 24, 2026
- securityaffairs.comF5 BIG-IP APM Zero-Day Exploited in Zero-Day RCE Attacks
1 article · September 23, 2026
- securityweek.comCritical F5 BIG-IP Vulnerability Exploited as Zero-Day
1 article · September 23, 2026
- thehackernews.comF5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers
2 articles · September 23, 2026
Topics and entities
Entities
- Shadowserver
- BIG-IP Access Policy Manager
- F5
- CISA Known Exploited Vulnerabilities Catalog
- Rapid7
- OAuth
- CISA