F5 BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

A zero-day aimed at a narrow but dangerous BIG-IP APM configuration

F5 BIG-IP Access Policy Manager administrators are facing an active zero-day incident centered on CVE-2026-94127, a critical vulnerability that can allow unauthenticated remote code execution when BIG-IP APM is configured in a specific OAuth authorization-server role [1]. The issue is not a generic flaw in every APM deployment; it applies when an APM access policy and an OAuth profile are configured together on a virtual server, and F5’s CVE record states that the vulnerable condition exists when BIG-IP APM is operating as an OAuth Authorization Server [1].

That configuration detail matters because it narrows the immediate exposure check. Deployments using APM strictly as an OAuth Client or Resource Server, without OAuth authorization-server profiles configured, are described as not affected by this vulnerability [1]. For environments that do match the vulnerable pattern, however, the risk is severe: specially crafted traffic can reach the data plane and lead to remote code execution without requiring credentials [1].

The vulnerability has been assigned CVSS 3.1 score 9.8 and CVSS 4.0 score 9.3, with network attack vector, low attack complexity, no privileges required, and no user interaction required [1]. The weakness is tracked as CWE-122, a heap-based buffer overflow, and the Canadian Centre for Cyber Security described the outcome as possible arbitrary code execution and potential full system compromise under the vulnerable OAuth/APM conditions [2].

What is affected and what is not

The affected product line is F5 BIG-IP with the APM module, specifically versions 17.1.0 before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG, 17.5.0 before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, and 21.1.0 before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG [1]. Canada’s cyber authority published the same fixed hotfix targets and urged organizations running affected APM deployments to upgrade to the vendor-supported hotfix releases [2].

F5’s record also states that the BIG-IP system remains vulnerable in Appliance mode, which means teams should not assume that a hardened appliance posture removes the need for patching [1]. At the same time, the issue is described as a data-plane vulnerability with no control-plane exposure, so the most important exposure question is whether the vulnerable virtual server configuration is reachable by attackers, partners, or other untrusted networks [1].

Versions that have reached end of technical support were not evaluated, according to the CVE record [1]. That caveat is operationally important: a legacy appliance that appears outside the named supported release set should not be treated as safe merely because it is absent from the evaluated list. If it runs BIG-IP APM in the same OAuth authorization-server pattern, defenders should isolate, replace, or obtain direct vendor guidance rather than infer non-exposure.

Active exploitation changes the response timeline

This is not a routine “patch when convenient” advisory. F5 indicated that CVE-2026-94127 has been exploited in the wild, and both Canada’s Cyber Centre and CERT-EU echoed the active-exploitation warning in alerts released on September 22, 2026 [2], [3]. OpenCVE’s CVE record also shows CISA enrichment marking exploitation as active, automatable as yes, and technical impact as total [1].

CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities catalog on September 22, 2026, with a due date of September 25, 2026 for federal remediation tracking [1]. SecurityWeek reported that the KEV listing came as F5 and CISA warned organizations about exploitation of the BIG-IP APM zero-day, and noted that federal agencies were urged to patch within three days under the current directive framework [5]. For non-federal organizations, KEV inclusion is still a strong prioritization signal: exploitation is no longer hypothetical.

The internet-facing footprint is also meaningful. BleepingComputer reported that Shadowserver was tracking more than 14,700 IP addresses with BIG-IP APM fingerprints, while noting that the number does not show how many systems are vulnerable, already patched, or honeypots [4]. The count should not be read as a victim estimate, but it does show why exposed APM services quickly become attractive targets when an unauthenticated RCE path is confirmed.

Detection: what defenders should look for

CERT-EU’s compromise-assessment guidance focuses on the correlation of several symptoms, rather than treating one noisy log line as proof. At a high level, it said multiple OAuth authentication failures followed by suspicious commands and then a TMM SIGABRT should trigger human review of the system [3]. That sequence is useful because an OAuth-facing exploit attempt may first look like authentication noise before it becomes device-level activity.

The first recommended check is in /var/log/apm, where teams should review repeated OAuth UserInfo failures, especially ten or more occurrences from a single IP address in a short period [3]. CERT-EU also advises checking OAuth failure statistics with tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed and looking for unexplained increases in total_failed [3].

If OAuth failures appear suspicious, defenders should review /var/log/audit around the same timestamps for unexpected commands [3]. TMM core files also deserve investigation: their presence alone is not an indicator of compromise, but F5 observed TMM entering a loop that caused the SOD daemon to send a SIGABRT, according to CERT-EU’s summary [3]. Canada’s Cyber Centre separately recommended reviewing access logs for indicators of compromise, including rapid or high-volume OAuth authentication failures, and checking administrative accounts and access policies for suspicious changes [2].

Mitigation when patching cannot happen immediately

The primary remediation is to install the relevant F5-supported hotfix for the deployed branch [2]. For organizations that cannot patch immediately, both Canada’s Cyber Centre and CERT-EU point to an F5-provided iRule mitigation that customers must obtain through F5 Support and apply to the affected BIG-IP APM virtual server [2], [3]. This should be treated as a temporary risk-reduction measure, not a substitute for moving to a fixed build.

A practical triage plan starts with inventory. Teams should identify every BIG-IP virtual server where an APM access policy and OAuth profile are configured together, then determine whether the OAuth profile makes the device an OAuth Authorization Server [1], [2]. Those systems should be ranked ahead of APM deployments that do not match the authorization-server condition.

Next comes exposure control. If a vulnerable virtual server is internet-facing or reachable from partner networks, administrators should consider emergency change windows, temporary access restrictions, or service isolation until the hotfix or iRule is in place. Canada’s Cyber Centre also recommends restricting management interfaces to trusted administrative networks, a baseline control that remains important even though this particular bug is described as a data-plane issue [2].

Why this flaw is strategically sensitive

BIG-IP APM often sits at the edge of enterprise identity, remote access, and application-delivery architectures. A vulnerability that combines no authentication, network reachability, and code execution therefore compresses the attacker’s path from probing to potential device compromise. Because the vulnerable condition involves OAuth authorization-server behavior, the incident also sits near the trust fabric that organizations use to broker access to applications and APIs.

The strongest defensive stance is to assume that vulnerable, reachable systems may have been touched before patching. CERT-EU explicitly recommends preserving forensic evidence, applying the relevant hotfix, and checking for signs of compromise; if any sign is found, organizations should begin incident response [3]. That order matters: patching closes the door, but it does not by itself answer whether an intruder already gained a foothold.

The current state of the story is therefore clear. CVE-2026-94127 is a critical BIG-IP APM OAuth authorization-server vulnerability, actively exploited in the wild, with vendor hotfixes available for supported affected branches and a vendor iRule workaround for customers that need interim mitigation [1], [2], [3]. Organizations should not wait for public exploit code or confirmed victim lists; the combination of active exploitation, unauthenticated RCE, KEV listing, and edge-device exposure is already enough to justify emergency handling.

Developments

1. F5 Fixes Critical Zero-Day Exploit on BIG-IP APM for Unauthorized RCEthehackernews.com · Sep 23, 2026, 8:22 AM UTC · 9/10

Sources from the last 72 hours

1. [1]CVE-2026-94127 - Vulnerability Details - OpenCVESep 22, 2026, 2:17 PM UTC
2. [2]Alert - AL26-022 - Vulnerability impacting F5 BIG-IP Access Policy Manager (APM) – CVE-2026-94127Sep 22, 2026, 12:00 AM UTC
3. [3]Security Advisory 2026-013: Critical Vulnerability in F5 BIG-IP APMSep 22, 2026, 2:52 PM UTC
4. [4]F5 patches BIG-IP APM zero-day flaw exploited in RCE attacksSep 23, 2026, 7:17 AM UTC
5. [5]Critical F5 BIG-IP Vulnerability Exploited as Zero-DaySep 23, 2026, 7:34 AM UTC

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.