"Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says."
CVE-2026-94127: a heap-based buffer overflow allowing unauthenticated RCE
F5 disclosed a critical vulnerability, tracked as CVE-2026-94127, on September 22 and released engineering hotfixes the same day. The flaw is a heap-based buffer overflow that F5 scores 9.8/10 on CVSS v3.1 and 9.3/10 on CVSS v4.0. According to F5, specially crafted malicious traffic sent to a particular virtual server can lead to remote code execution on a BIG‑IP system without a valid login.
Which BIG-IP installations are affected — APM as an OAuth authorization server
F5 says the vulnerability affects only BIG-IP systems where Access Policy Manager (APM) is configured to act as an OAuth authorization server — that is, issuing access tokens to applications. The vulnerable configuration is when an APM access policy and an OAuth authorization server profile are both present on the same virtual server that receives OAuth traffic.
F5 updated its CVE record at 00:45 UTC on September 23 to clarify the flaw is present only in the authorization server role. Earlier advisories from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and CERT‑EU described the condition more broadly as an access policy and an OAuth profile on a virtual server.
F5's configuration guide for APM 17.1, 17.5 and 21.0 shows the OAuth authorization server profile is created under Access > Federation > OAuth Authorization Server > OAuth Profile and then selected in an access profile attached to the virtual server — a setup that matches F5's description. Systems that use APM only as an OAuth client or resource server, with no authorization server profiles, are not affected. BIG-IP systems running in Appliance mode are also vulnerable, and restricting access to the management interface does not mitigate this risk because malicious traffic targets the virtual server itself.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageMitigations and the CISA directive: hotfixes, iRule, and deadlines
F5 released engineering hotfixes for the affected branches and, where customers cannot install the hotfix immediately, offers an iRule mitigation for the affected virtual server. Customers must obtain the iRule by opening a ticket with F5 support. CERT‑EU advises preserving forensic evidence first, applying the hotfix, checking for signs of compromise, and beginning incident response if signs are found. CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog on September 22 and directed federal civilian agencies to apply F5's mitigations by September 25 under a directive it issued in June. CISA also advised agencies to apply the iRule first "to allow for proactive forensic triage," and then to "install the final vendor patch as soon as possible."
What to look for: F5-identified indicators of possible compromise
F5's indicators, summarized in CERT‑EU's advisory, lay out a sequence that should prompt human review: repeated OAuth authentication failures, suspicious commands in audit logs, followed by a TMM SIGABRT. The specific signs listed are:
- APM log: repeated failed UserInfo requests in /var/log/apm with the error "The access token is invalid." Look for about 10 or more requests from a single IP address in a short time frame.
- OAuth counter: an unexplained rise in total_failed when running tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed.
- Audit log: suspicious commands in /var/log/audit occurring around the time of those failures.
- TMM core files: not conclusive by themselves, but F5 has observed TMM entering a loop that causes the SOD daemon to send a SIGABRT, which merits investigation.
F5's CVE record and the advisories from CISA and CERT‑EU do not state whether installing the hotfix will remove access that an attacker already has on a compromised system.
What this means for federal civilian agencies, F5 customers, and incident responders
- Federal civilian agencies: CISA's KEV listing and the September 25 mitigation deadline require agencies to apply the iRule mitigations immediately and the vendor hotfix as soon as possible to meet the directive's timetable.
- F5 customers and procurement leaders: Any deployment where APM plays the authorization server role on a virtual server must be assessed against the affected builds and, if applicable, patched with the engineering hotfix or protected with the vendor-provided iRule obtained via F5 support.
- Incident responders and CERT‑EU teams: Preserve forensic evidence before mitigation where feasible, monitor the specific log indicators F5 described, and initiate incident response if the combination of failed UserInfo requests, suspicious commands, and a TMM SIGABRT is observed.
Two concrete unknowns remain in the public record: F5's CVE entry and CISA's KEV listing do not disclose how many systems have been attacked, who the attackers are, or which organizations were targeted. That absence — paired with a CISA-mandated deadline for federal agencies and the advisory-level severity scores — frames the immediate operational imperative: identify authorization-server roles on BIG‑IP virtual servers now, apply the iRule for triage where needed, and install F5’s engineering hotfixes without delay.
