Full Report
Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes.
Analysis Summary
# Vulnerability: F5 BIG-IP APM Zero-Day Unauthenticated Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-94127
- **CVSS Score:** 9.8 (Critical) via CVSS v3.1 / 9.3 (Critical) via CVSS v4.0
- **CWE:** Heap-based buffer overflow
## Affected Systems
- **Products:** F5 BIG-IP Access Policy Manager (APM)
- **Versions:**
- Branch 21.1: 21.1.0 (before hotfix)
- Branch 17.5: 17.5.0 to 17.5.1 (before hotfix)
- Branch 17.1: 17.1.0 to 17.1.3 (before hotfix)
- *Note:* Systems that have reached End of Technical Support were not evaluated.
- **Configurations:** Only systems configured where APM serves as an OAuth authorization server (issuing access tokens to applications). Specifically, this applies when an APM access policy and an OAuth authorization server profile are hosted on the same virtual server receiving OAuth traffic. Systems in Appliance mode are also vulnerable. Restricting access to the management interface does not mitigate the risk.
## Vulnerability Description
The flaw is a heap-based buffer overflow vulnerability within the F5 BIG-IP Access Policy Manager (APM). When specific malicious network traffic is directed at an affected virtual server acting as an OAuth authorization server, an unauthenticated attacker can exploit the vulnerability to execute arbitrary code on the BIG-IP system.
## Exploitation
- **Status:** Exploited in the wild (Active zero-day; added to CISA's Known Exploited Vulnerabilities catalog).
- **Complexity:** Low (Requires sending specific malicious traffic to the virtual server without prior authentication).
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Allows unauthenticated Remote Code Execution)
- **Integrity:** High (Allows unauthorized system modification)
- **Availability:** High (Allows full system compromise and can trigger TMM crashes)
## Remediation
### Patches
F5 has released engineering hotfixes for the affected branches:
- **Branch 21.1:** Install `Hotfix-BIGIP-21.1.0.2.0.30.22-ENG`
- **Branch 17.5:** Install `Hotfix-BIGIP-17.5.1.9.0.160.12-ENG`
- **Branch 17.1:** Install `Hotfix-BIGIP-17.1.3.5.0.41.14-ENG`
### Workarounds
- **iRule Mitigation:** F5 provides an interim iRule mitigation for the affected virtual server. Customers must open a support ticket with F5 to obtain it. CISA recommends applying the iRule proactively to allow for forensic triage before installing the final patch.
## Detection
The following combination of indicators should trigger a formal human review and incident response:
- **Log Indicators:** Repeated OAuth authentication failures inside the APM log.
- **Behavioral Indicators:** Execution of suspicious commands.
- **System Events:** A Traffic Management Microkernel (TMM) `SIGABRT` crash occurring shortly after the repeated authentication failures.
## References
- F5 Advisory: hxxps://my[.]f5[.]com/manage/s/article/K000162605
- CVE Record: hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-94127
- CERT-EU Advisory: hxxps://cert[.]europa[.]eu/publications/security-advisories/2026-013
- F5 Configuration Reference: hxxps://techdocs[.]f5[.]com/en-us/bigip-17-1-0/big-ip-access-policy-manager-oauth-configuration/using-apm-as-an-oauth-2-server[.]html
- Original Article: hxxps://thehackernews[.]com/2026/09/f5-patches-critical-big-ip-apm-zero-day[.]html