Actively Exploited BIG-IP APM Flaw Gives Remote Attackers a Path to Code Execution

Zero-day attacks target a specific BIG-IP role

F5 has released fixes for CVE-2026-94127, a critical heap-based buffer overflow in BIG-IP Access Policy Manager that attackers are already exploiting for remote code execution.

The vulnerability was published on September 22, 2026, and the NVD record was modified on September 23, 2026. F5 has confirmed exploitation, making this a zero-day rather than a theoretical risk.

An unauthenticated attacker can trigger the flaw by sending specially crafted network traffic to a vulnerable BIG-IP deployment. Successful exploitation can allow arbitrary code execution without credentials or user interaction.

However, the exposure is configuration-dependent. A BIG-IP APM virtual server is vulnerable when all three of these conditions apply:

1. An APM access policy is attached to the virtual server.
2. An OAuth profile is configured on that server.
3. APM operates as an OAuth Authorization Server.

Deployments using APM exclusively as an OAuth Client or Resource Server, without an OAuth Authorization Server profile, are not affected. BIG-IP systems running in Appliance mode remain vulnerable if they meet the configuration requirements.

Heap corruption occurs in the data plane

CVE-2026-94127 is classified as CWE-122, a heap-based buffer overflow. The flaw resides in BIG-IP’s data plane, which processes traffic handled by the appliance.

Malformed network input can exceed the bounds of a heap-allocated memory region. Depending on the corrupted memory structures and the attacker’s ability to control them, a heap overflow can crash a process or redirect execution toward attacker-controlled code.

For this vulnerability, F5 describes remote code execution as the security impact. The attacker does not need an account, access token, or prior foothold.

The supplied F5 CNA vector is:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

It describes a network-reachable issue with low attack complexity, no additional attack requirements, no privileges, and no user interaction. Exploitation can have high confidentiality, integrity, and availability effects on the vulnerable BIG-IP system.

NIST has not provided its own numeric CVSS assessment. The F5 CNA supplied a complete CVSS 4.0 vector, while the vulnerability also carries a CVSS 3.1 score of 9.8 with this vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The NVD entry states that the control plane is not exposed through this flaw. That distinction limits the documented attack surface, but it does not reduce the urgency of an unauthenticated code-execution path on the traffic-processing plane.

Exact affected releases and hotfix boundaries

The affected-product records identify three BIG-IP branches and their precise hotfix thresholds:

BIG-IP release	Affected builds
21.1.0	Builds below Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
17.5.0	Builds below Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
17.1.0	Builds below Hotfix-BIGIP-17.1.3.5.0.41.14-ENG

The broader affected release ranges are BIG-IP 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3. Administrators should use the exact hotfix boundaries when checking appliances because a release-family match alone does not establish whether remediation has already been installed.

Software that has reached End of Technical Support was not evaluated. Its vulnerability status is therefore unknown and should not be interpreted as unaffected.

F5 has not identified another product as vulnerable. The defect was reportedly found internally, even though attackers had already used it in the wild.

Authentication failures and TMM aborts may expose attacks

F5 published three indicators of compromise, but the available technical details do not include concrete filenames, hashes, commands, or IP addresses. Administrators can still investigate the behavioral sequence associated with attempted exploitation.

Signals to correlate include:

• Repeated OAuth authentication failures
• Suspicious command execution
• A subsequent TMM SIGABRT event

A TMM SIGABRT indicates that the BIG-IP Traffic Management Microkernel terminated abnormally. In isolation, such an abort does not prove exploitation. Its occurrence shortly after multiple OAuth failures and unexpected commands is more significant.

F5 advises defenders to examine the combination and repetition of these events rather than relying on one log entry. Investigations should cover OAuth authentication records, command activity, process crashes, abort logs, configuration changes, and evidence of post-exploitation persistence.

No precise time window has been disclosed for the sequence. Security teams should therefore correlate surrounding activity broadly instead of restricting searches to a narrowly defined interval.

Shadowserver has observed more than 14,700 IP addresses carrying BIG-IP APM fingerprints. That number represents potential exposure, not confirmed vulnerable or compromised systems. It may include patched appliances, deployments without the vulnerable OAuth role, and honeypots.

CISA sets a September 25 federal deadline

CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities Catalog on September 22, 2026, confirming that the flaw meets the agency’s active-exploitation criteria.

U.S. Federal Civilian Executive Branch agencies must remediate it by September 25, 2026. Under BOD 26-04, agencies must apply vendor mitigations, meet CISA’s forensic-triage requirements, evaluate each asset’s internet exposure, and follow the applicable patching rules. If a cloud deployment cannot be mitigated, the required action is to discontinue its use.

CISA recommends that other organizations also prioritize KEV-listed vulnerabilities, particularly when an internet-facing appliance could be fully compromised. Forensic triage should occur before or alongside patching so that remediation does not erase evidence of an earlier intrusion.

The same CISA catalog update added three unrelated flaws with the same September 25, 2026 remediation deadline:

• CVE-2026-85102, a Check Point certificate-validation vulnerability rated CVSS 9.8
• CVE-2026-93616, a Check Point path-traversal vulnerability rated CVSS 9.8
• CVE-2026-93952, an Arista VeloCloud Orchestrator input-validation flaw rated CVSS 10

These issues are separate from the F5 zero-day.

Patching and temporary mitigation

Organizations should first identify virtual servers that combine an APM access policy with an OAuth profile. They must then determine whether each instance acts as an OAuth Authorization Server and compare its full build and hotfix level against the affected boundaries.

F5’s security updates and hotfixes are the preferred remediation. Reboot, failover, and validation requirements should follow the vendor’s instructions for the relevant BIG-IP branch.

Where immediate patching is impossible, F5 provides an iRule mitigation that can be applied to the affected APM virtual server. The rule must be obtained directly from F5 Support; its contents have not been publicly specified in the available information. Administrators should avoid unverified third-party copies.

A practical response sequence is:

1. Inventory BIG-IP APM virtual servers and their OAuth roles.
2. Identify internet-facing authorization-server deployments.
3. Record the complete build and installed hotfix level.
4. Search for OAuth failures, suspicious commands, and TMM SIGABRT.
5. Preserve relevant logs and conduct forensic triage.
6. Install the appropriate F5 update or hotfix.
7. Use the F5-provided iRule only as an interim measure.
8. Remove or discontinue systems that cannot be secured.

A recurring target for advanced attackers

CVE-2026-94127 joins a series of actively exploited F5 vulnerabilities. Since November 2021, CISA has placed eight exploited F5 flaws in KEV; four were also associated with ransomware activity.

F5 disclosed in October 2025 that state-sponsored attackers had breached its systems in August 2025 and stolen undisclosed BIG-IP security source code and vulnerability information.

The company serves more than 23,000 customers, including 48 of the Fortune 50 and 80% of the Fortune Global 500. That footprint, combined with unauthenticated exploitation on an access-management appliance, makes rapid patching and compromise assessment necessary—not interchangeable tasks.