F5 patches exploited BIG-IP zero-day in APM OAuth servers

A zero-day at the identity gateway

F5’s latest BIG-IP emergency is the kind of vulnerability that security teams cannot treat as routine maintenance. CVE-2026-94127 affects BIG-IP Access Policy Manager, or APM, and allows unauthenticated remote code execution when the device is configured with an APM access policy and an OAuth profile on a virtual server [1]. F5 has confirmed exploitation in the wild, which turns the issue from a theoretical perimeter bug into an active incident-response problem [3].

The risk is amplified by where BIG-IP APM usually sits. APM is used as a centralized access management proxy for applications, APIs, cloud services and internal networks, so a vulnerable system can be upstream of many business-critical services [1]. In the affected configuration, APM is acting as an OAuth authorization server, the role that issues access tokens to applications; F5’s clarification says deployments using APM strictly as an OAuth client or resource server are not affected if no OAuth authorization server profile is configured [2].

That distinction matters operationally. Many organizations will have BIG-IP appliances, but not every BIG-IP appliance is vulnerable to this specific flaw. The practical first step is therefore configuration inventory: identify virtual servers where APM access policies and OAuth authorization server profiles meet, then map those systems to the affected software branches.

What CVE-2026-94127 does

The vulnerability is a heap-based buffer overflow with a CVSS v3.1 score of 9.8, and CERT-EU says it can let an unauthenticated attacker achieve remote code execution on the affected device [3]. In plain terms, specially crafted traffic to the vulnerable virtual server can become code execution before the attacker has valid credentials [4].

That is why this flaw is especially serious for access infrastructure. The exposure is on the data plane, not the management plane, so restricting the administrative interface is good hygiene but does not remove the vulnerable attack surface by itself [2]. BleepingComputer also notes that BIG-IP systems in Appliance mode remain vulnerable and that exploitation targets the configured virtual server rather than the management interface [1].

The public advisories do not attribute the exploitation to a named threat actor, do not disclose the number of compromised organizations, and do not say how many vulnerable systems were already patched by September 23, 2026 [2]. Shadowserver visibility cited by BleepingComputer showed more than 14,700 IP addresses with BIG-IP APM fingerprints, although that figure does not equal the number of vulnerable, exposed or compromised devices [1]. It is still a useful reminder that BIG-IP APM is widely visible enough to attract rapid scanning once a critical bug becomes public.

Affected versions and fixes

The affected supported branches are narrow but important. The Canadian Centre for Cyber Security lists BIG-IP APM 17.1.0 through 17.1.3, 17.5.0 through 17.5.1, and 21.1.0 as affected under the relevant OAuth/APM configuration [4]. The fixed hotfixes identified in the same alert are Hotfix-BIGIP-17.1.3.5.0.41.14-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, and Hotfix-BIGIP-21.1.0.2.0.30.22-ENG [4].

CERT-EU’s recommendation is direct: preserve forensic evidence, apply the relevant hotfix, check for signs of compromise, and start incident response if those signs are present [3]. That sequence is important. If exploitation may already have happened, patching without evidence preservation can erase context that responders need to understand persistence, lateral movement, or command execution.

For organizations unable to patch immediately, F5 has provided an iRule-based mitigation for the affected virtual server, obtainable through F5 Support, according to CERT-EU and BleepingComputer [1][3]. This should be treated as a temporary control, not a final state. The vulnerability is already known to attackers, and CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog with a federal due date of September 25, 2026, according to the KEV entry mirrored by CIRCL and reporting from BleepingComputer [1][6].

What defenders should check now

The compromise checks are unusually concrete. CERT-EU says the high-level pattern requiring human review is multiple OAuth authentication failures, followed by suspicious commands, and then a TMM SIGABRT shortly afterward [3]. That sequence gives defenders a hunt hypothesis: token-related failures may be the first visible sign, command execution may follow, and a Traffic Management Microkernel crash or abort may appear after the exploit path destabilizes the process.

Log review should begin with /var/log/apm, looking for repeated failed UserInfo requests, especially ten or more from one IP address in a short period [3]. Teams should also check OAuth statistics for an unexplained increase in total_failed using tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed [3]. If those indicators are present, the next step is to review /var/log/audit around the same timestamps for suspicious commands and investigate any TMM core files, even though a core file alone is not proof of compromise [3].

CIS frames the likely attack technique as exploitation of a public-facing application under MITRE ATT&CK Initial Access, and warns that successful exploitation could result in full control of the affected system [5]. That means the investigation should not stop at confirming whether the hotfix installed successfully. Administrators should review local accounts, recent configuration changes, access policies, unexpected files, outbound connections and any downstream identity or application systems that trusted the BIG-IP device.

Why this patch deserves priority

The urgency here is not only the CVSS score. Many high-severity vulnerabilities compete for patch windows, but CVE-2026-94127 combines four uncomfortable traits: no authentication requirement, remote code execution, active exploitation and placement on identity-adjacent edge infrastructure [1][3][5]. A compromised APM gateway can become a powerful foothold because it sees authentication flows and brokers access to other services.

The correct response is therefore layered. First, identify whether any BIG-IP APM virtual servers are configured in the affected OAuth authorization server role. Second, apply the relevant F5 hotfix or the temporary iRule mitigation where patching cannot be immediate. Third, preserve forensic evidence and run the compromise checks before assuming the device is clean. Finally, verify that segmentation and monitoring around the appliance can catch post-exploitation activity, not just the initial exploit attempt.

The most dangerous mistake would be to treat this as a simple “install and forget” vendor patch. F5’s own exploitation confirmation, the CISA KEV listing and the government advisories all point to a different conclusion: organizations with affected BIG-IP APM deployments should handle CVE-2026-94127 as both a patching emergency and a possible breach investigation [3][4][6].

Sources from the last 72 hours

1. [1]F5 patches BIG-IP APM zero-day flaw exploited in RCE attacksSep 23, 2026, 7:17 AM UTC
2. [2]F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth ServersSep 23, 2026, 12:00 AM UTC
3. [3]Security Advisory 2026-013: Critical Vulnerability in F5 BIG-IP APMSep 22, 2026, 2:52 PM UTC
4. [4]Alert - AL26-022 - Vulnerability impacting F5 BIG-IP Access Policy Manager (APM) – CVE-2026-94127Sep 22, 2026, 4:00 AM UTC
5. [5]A Vulnerability in F5 BIG-IP Access Policy Manager Could Allow for Remote Code ExecutionSep 22, 2026, 4:00 AM UTC
6. [6]KEV Entry: CVE-2026-94127Sep 22, 2026, 8:00 PM UTC

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.