F5 Networks — Critical Zero-Day Remote Code Execution in BIG-IP APM During OAuth Traffic Processing (CVE-2026-94127)

Publication date: September 23, 2026
Category: Vulnerability / Network Security

Introduction

F5 has issued critical advisories and urgent engineering hotfixes to remediate an actively exploited zero-day vulnerability tracked as CVE-2026-94127, affecting the BIG-IP Access Policy Manager (APM) module. The flaw allows unauthenticated remote attackers to achieve remote code execution (RCE) on target systems by submitting specially crafted malicious traffic. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) promptly added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating swift mitigation for federal civilian agencies. This report examines the underlying technical mechanisms, vulnerable environments, and tactical countermeasures recommended by vendors and incident response centers.

What is F5 BIG-IP APM and Vulnerability CVE-2026-94127? (General Analysis)

F5 BIG-IP Access Policy Manager (APM) is an identity-aware access control and security gateway module integrated into F5 application delivery controllers (ADCs), responsible for managing how users and clients authenticate and access corporate network resources.

The CVE-2026-94127 vulnerability occurs exclusively when the APM module is explicitly configured as an OAuth Authorization Server alongside an access policy attached to the same virtual server. When an attacker transmits malicious requests to this specific network endpoint, it triggers a heap-based buffer overflow, formally classified as CWE-122.

Official severity metrics confirmed by the NVD database are as follows:

  • Official CVSS Score and Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X — 9.3 (CRITICAL, CVSS v4.0) / 9.8 (CVSS v3.1 vendor-reported).
  • Official CWE Classification: CWE-122 (Heap-based Buffer Overflow).
  • CISA KEV Status: Confirmed in the active exploitation catalog.

Additionally, the prior historical flaw CVE-2025-53521 (classified under CWE-121 - Stack-based Buffer Overflow, bearing an identical 9.3 CRITICAL score) shares attack surface similarities within APM access policies, underlining an ongoing pattern of vulnerabilities in traffic management microkernel (TMM) processing routines.

How Does It Work? (Technical Analysis)

The exploitation mechanism relies on manipulating the data plane of BIG-IP network appliances. The technical attack flow unfolds as follows:

  • Entry Vector and Data Plane Exposure: Malicious traffic is directed straight to the virtual server configured on the BIG-IP hosting the OAuth profile and APM access policy. Because this vector operates within the data plane, restricting or isolating access to the administrative management interface does not protect against this flaw. Systems running in Appliance mode are similarly vulnerable.
  • Heap Buffer Corruption: While parsing HTTP requests or malformed data structures tied to OAuth server endpoints (such as token validation or UserInfo requests), APM’s protocol parser improperly manages buffer boundaries within dynamically allocated heap memory, corrupting internal control structures of the multi-processor Traffic Management Microkernel (TMM).
  • Code Execution and Daemon Instability: Memory corruption enables an attacker to inject and execute arbitrary code with elevated privileges on the underlying operating system. As an operational side-effect, this overflow frequently forces processing loops within TMM, causing system supervisor daemons (such as SOD) to trigger termination via the SIGABRT signal along with core file generation.

Affected Systems / Environments

Exposed versions correspond to software branches maintaining active support that harbor OAuth authorization server profiles in their APM configurations:

CVECategory (CWE)ImpactCVSSVector (summarized)
CVE-2026-94127CWE-122 (Heap Overflow)Unauthenticated RCE9.3 (Critical)AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H
CVE-2025-53521CWE-121 (Stack Overflow)Unauthenticated RCE9.3 (Critical)AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H

F5 BIG-IP versions affected by CVE-2026-94127 and official engineering patches:

  • Branch 21.1: Versions 21.1.0 (prior to hotfix) — Required Patch: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
  • Branch 17.5: Versions 17.5.0 to 17.5.1 (prior to hotfix) — Required Patch: Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
  • Branch 17.1: Versions 17.1.0 to 17.1.3 (prior to hotfix) — Required Patch: Hotfix-BIGIP-17.1.3.5.0.41.14-ENG

Architectural Note: Deployments utilizing APM strictly as an OAuth Client or Resource Server (without OAuth authorization server profiles configured) are not affected by this specific vulnerability.

Mitigation and Detection

Remediation

  1. Hotfix Installation: Prioritize the immediate deployment of official engineering packages provided by F5 for each affected software branch.
  2. Temporary iRule Mitigation: In environments where immediate patch deployment requires scheduling maintenance windows, administrators should open a support ticket with F5 to deploy a specialized iRule on the impacted virtual server, allowing proactive forensic triage before permanent patching.

Detection

Defensive and incident response teams should actively hunt for the following compromise artifacts suggested by CERT-EU and F5:

  • APM Logs (/var/log/apm): Search for repeated, failed UserInfo requests accompanied by the error description “The access token is invalid.” Special attention should be given to 10 or more requests originating from a single IP address within a short timeframe.
  • Global OAuth Counters: Inspect anomalous increases in the total_failed parameter by running the command:
    bash 
    tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed
  • Audit Logs (/var/log/audit): Review suspicious commands executed around the timestamps of authentication failures.
  • Core Files: Investigate unexpected traffic engine restarts coupled with SIGABRT signals issued by the SOD daemon.

Security Warning: “The presence of repeated OAuth validation failures followed by suspicious command execution and abrupt traffic engine terminations (TMM SIGABRT) serves as a strong indicator of active data plane exploitation.”

Wrapping Up

The emergence of the zero-day vulnerability CVE-2026-94127 in F5 BIG-IP APM highlights the risks inherent in complex federation and identity components like OAuth servers. Because the flaw resides in the data plane and permits unauthenticated remote code execution, organizational response must be immediate through the deployment of official engineering hotfixes and rigorous monitoring of APM global counters and system logs.

References