Summary

F5 disclosed CVE-2026-94127 (CVSS v3.1 9.8 / CVSS v4.0 9.3, both Critical), a heap-based buffer overflow (CWE-122) in BIG-IP Access Policy Manager (APM) that allows an unauthenticated attacker to achieve remote code execution when a virtual server has both an APM access policy and an OAuth profile configured as an OAuth Authorization Server. F5's own advisory (K000162605) states directly: "We have learned that this vulnerability has been exploited." CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-22 with a remediation due date of 2026-09-25 and a forensic-triage requirement, independently corroborating the urgency. The issue was discovered internally by F5, not by an external researcher.

Affected Systems and/or Applications

Per F5's K000162605 advisory, only BIG-IP APM is vulnerable, and only when configured as an OAuth Authorization Server:

• BIG-IP APM, branch 21.x: version 21.1.0
• BIG-IP APM, branch 17.x: versions 17.5.0-17.5.1 and 17.1.0-17.1.3

Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected.

All other evaluated F5 products and modules — BIG-IP AFM, ASM, Analytics, DDoS Hybrid Defender, DNS, FPS, LTM, Link Controller, all other BIG-IP modules, BIG-IP Next CNF/for Kubernetes, BIG-IQ Centralized Management, F5 Distributed Cloud (all services), F5 AI Gateway, F5OS/F5OS-A/F5OS-C, and all NGINX products — are explicitly listed "Not vulnerable" in F5's evaluation tables.

The BIG-IP system in Appliance mode is also vulnerable. This is a data-plane issue; there is no control-plane exposure.

Technical Details

Vulnerability Mechanism

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server as an OAuth Authorization Server, specific malicious traffic sent to that virtual server can trigger a heap-based buffer overflow (CWE-122), leading to remote code execution without authentication (F5 K000162605; NVD CVE-2026-94127).

Observed Exploitation Path

F5 states directly: "We have learned that this vulnerability has been exploited." F5's advisory does not narrate a detailed attacker TTP timeline beyond confirming exploitation occurred and providing the Indicators of Compromise reproduced under Threat Hunting below. The Hacker News additionally reported that "Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM)," consistent with F5's own statement. This issue was discovered internally by F5, not reported by an external researcher.

Key Points

• CVSS v3.1 9.8 / CVSS v4.0 9.3, both Critical; unauthenticated, network-exploitable; CWE-122; F5 Product Development ID 2524777.
• F5 directly confirms active exploitation in its own advisory.
• Listed in CISA KEV as of 2026-09-22 with a due date of 2026-09-25 and forensic-triage flagged, under BOD 26-04.
• Scoped narrowly to BIG-IP APM configured as an OAuth Authorization Server; all other evaluated F5/NGINX products and modules are not vulnerable.
• No FIRST EPSS score is available yet, consistent with how recently this CVE was published; this does not diminish the confirmed KEV listing and vendor-confirmed in-the-wild exploitation.
• Tenable's Plugins Pipeline lists a Development-stage entry for this CVE (tracking ID 231663-0, updated 2026-09-22); Qualys coverage could not be confirmed or ruled out through available tooling at assessment time.

Mitigation

Immediate Actions for Self-Hosted Instances

Limit Exposure

Review which virtual servers have both an APM access policy and an OAuth profile configured as an OAuth Authorization Server; these are the only exposed configurations (F5 K000162605).

Patch/Upgrade

Apply the engineering hotfix for the affected branch (F5 K000162605):

• 21.x: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso
• 17.5.x: Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso
• 17.1.x: Hotfix-BIGIP-17.1.3.5.0.41.14-ENG.iso

These hotfixes are available on F5 Downloads and contain all fixes in BIG-IP Hardened Releases 2 (HR2). If a version prior to the one you are running (in the same branch) is listed as fixed, your version already has the fix.

If immediate installation is not possible, apply the vendor-provided iRule mitigation to the affected BIG-IP APM virtual server by contacting F5 Support to obtain it (F5 K000162605). CERT-EU additionally advises preserving forensic evidence before patching, then checking for compromise indicators and initiating incident response if findings emerge (The Hacker News).

Threat Hunting

F5's "Indicators of Compromise for ID 2524777" section describes a high-level pattern: multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT, is the combination that should lead to human review of the system.

OAuth failures — a medium-confidence indicator. The signal is repetition, not mere presence: sustained repetition (10 or more in one log), especially from a single IP address, is the anomaly to review. Log message in /var/log/apm:‍


<DATE> <HOST> err tmm1[30975]: 01990004:3: <PROFILE_NAME>: 
Request UserInfo from Source ID (null) IP <IP> failed. Error Code (invalid_token) 
Error Description (The access token is invalid.)

Check OAuth failure statistics with:

$ tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed

An unexplained increase in total_failed warrants further investigation.

Audit logs — if the OAuth failure messages above are noticed, especially in rapid succession or large volume, note the timestamps and investigate /var/log/audit around those times.

TMM core file presence — F5 has observed TMM enter a loop that causes the SOD daemon to send a SIGABRT. Presence of a TMM core file alone is not an indicator, but core files should be investigated.

Three indicators observed close in time to one another — OAuth failures, suspicious commands, and a TMM SIGABRT — should be treated as reason to investigate further; any one alone does not necessarily mean compromise occurred, but the combination and frequency have been seen to correlate with an attack (F5 K000162605).

Assume Breach if Unpatched

No customer-specific evidence of internet/exposure status or compromise was obtained in this assessment, so this condition is not evidenced for any specific environment. Organizations that confirm a vulnerable BIG-IP APM virtual server configured as an OAuth Authorization Server was reachable before patching should treat that instance as a credible compromise scenario and follow the threat-hunting guidance above.

What the Cyber Fusion Center is Doing

The CFC is monitoring the situation and analyzing the case to identify potential threat-hunting campaigns. This advisory will be updated if required.

IDs

• CVE: CVE-2026-94127
• CWE: CWE-122 (Heap-based Buffer Overflow)
• Vendor Advisory: K000162605
• F5 Product Development ID: 2524777 (BIG-IP)
• CISA KEV: Listed 2026-09-22, due 2026-09-25
• Tenable: Development-stage pipeline entry, tracking ID 231663-0 (not yet a released plugin)
• Qualys ID: 388803

References

• F5 K000162605: BIG-IP APM vulnerability CVE-2026-94127: https://my.f5.com/manage/s/article/K000162605
• The Hacker News, "F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers": https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html
• NVD, CVE-2026-94127: https://nvd.nist.gov/vuln/detail/CVE-2026-94127
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Qualys QID 317880: https://www.qualys.com/vulnerability-detection-pipeline
• Tenable tracking ID 231663-0: https://www.tenable.com/plugins/pipeline/issues/231663-0