F5 BIG-IP APM CVE-2026-94127 Is Actively Exploited: Check OAuth Servers and Apply the Hotfix

By AiCybr Editorial · Published September 23, 2026

F5 has patched CVE-2026-94127, a critical heap-based buffer overflow in BIG-IP Access Policy Manager that can allow an unauthenticated network attacker to execute code on affected systems. F5 confirmed exploitation in the wild, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 22, 2026.

Exposure is configuration-specific. The vulnerable path exists when a BIG-IP APM virtual server uses both an APM access policy and an OAuth profile, with APM configured as an OAuth Authorization Server. Deployments using APM only as an OAuth Client or Resource Server without OAuth authorization-server profiles are outside the documented vulnerable configuration. Appliance mode remains affected when the vulnerable configuration is present.

Administrators should identify affected OAuth-enabled virtual servers, preserve forensic evidence, apply the appropriate F5 engineering hotfix and review the vendor-provided indicators for evidence of exploitation. CISA's KEV entry sets a September 25, 2026 remediation deadline for U.S. Federal Civilian Executive Branch agencies.

Affected BIG-IP APM versions and fixes

F5's advisory identifies three supported BIG-IP branches and corresponding engineering hotfixes. Software that has reached End of Technical Support was not evaluated by F5.

The published engineering-hotfix filenames identify the base build they target. Systems on an earlier affected build should first follow F5's supported upgrade path to the required base build, or obtain remediation specific to their installed build from F5 Support; administrators should not treat the listed engineering package as directly installable on every build in the affected range.

The vulnerability is tracked as CWE-122, heap-based buffer overflow. Published severity data rates it critical, with CVSS v3.1 at 9.8. Exploitation requires network access to the affected data-plane functionality and no authentication or user interaction.

This is a data-plane vulnerability. F5's description says the issue does not expose the BIG-IP control plane through this vulnerability, which helps narrow both exposure review and incident triage.

Check whether your configuration is exposed

Inventory BIG-IP virtual servers that use APM and inspect their OAuth configuration. The documented vulnerable combination is:

1. a virtual server with a BIG-IP APM access policy; and
2. an OAuth profile configured for APM to act as an OAuth Authorization Server.

Prioritize internet-facing authentication gateways and remote-access deployments because malicious traffic can reach the vulnerable processing path directly when the affected configuration is exposed.

Systems using APM strictly as an OAuth Client or Resource Server, without an OAuth authorization-server profile, are outside F5's documented affected configuration. That distinction can materially reduce the emergency-patching scope in environments with many APM deployments, while affected systems still require immediate remediation.

Compromise checks from F5

F5 supplied a sequence of telemetry that warrants human investigation. CERT-EU reproduced the vendor's compromise-assessment guidance in its September 22 advisory.

1. Review APM logs for repeated OAuth failures

Inspect /var/log/apm for repeated OAuth authentication failures. F5 specifically calls attention to clusters such as 10 or more failures from one source IP in a short period.

2. Check OAuth failure statistics

F5 recommends inspecting the global OAuth statistics and looking for an unexplained increase in total_failed:

tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed

3. Correlate with suspicious audit activity

Where OAuth failures are present, review /var/log/audit around the same timestamps for unexpected or suspicious commands. The combination of repeated authentication failures and subsequent command activity is more significant than either signal in isolation.

4. Investigate TMM crashes and core files

F5 observed cases in which Traffic Management Microkernel entered a loop and the SOD daemon subsequently sent SIGABRT. A TMM core file alone is insufficient to establish exploitation, but a core event following repeated OAuth failures and suspicious command activity matches the sequence F5 says should trigger manual review.

What to do now

Preserve evidence before making disruptive changes. F5 and CERT-EU recommend retaining forensic evidence, particularly when the telemetry above is present. Capture relevant APM and audit logs, configuration state and available core evidence according to the organization's incident-response process.

Apply the branch-specific engineering hotfix through its supported base build. Match the deployed BIG-IP build to the base encoded in the published hotfix name. If the appliance is on an earlier affected build, use F5's supported upgrade path to that base or obtain a build-specific remediation path from F5 Support before installing the engineering hotfix. Validate HA pairs and change-control requirements before rollout, while treating exposed OAuth Authorization Server deployments as the highest-priority systems.

Use F5's temporary mitigation when immediate patching is impossible. F5 provides an iRule-based mitigation for affected virtual servers through F5 Support. This is a temporary exposure-reduction path for systems that cannot receive the engineering hotfix immediately.

Escalate systems with matching indicators into incident response. Repeated OAuth failures followed by suspicious commands and a TMM crash warrant investigation for compromise rather than a patch-only response.

Review unsupported BIG-IP releases separately. F5 states that End-of-Technical-Support versions were not evaluated. Operators running such releases should use F5 support/lifecycle guidance to move to a supported remediation path.

Why this vulnerability is high priority

BIG-IP APM commonly sits directly in authentication and remote-access paths. CVE-2026-94127 reaches the data plane without credentials when the vulnerable OAuth Authorization Server configuration is exposed, and F5 has already confirmed real-world exploitation. CISA's KEV addition makes this an active-remediation event.

The configuration prerequisite also gives defenders a practical way to reduce the initial search space. Teams can identify virtual servers combining an APM access policy with an OAuth Authorization Server profile, patch those systems first, and use F5's telemetry sequence to determine which appliances need deeper forensic review.

Sources

• F5, CVE-2026-94127 BIG-IP APM OAuth vulnerability advisory (K000162605): https://my.f5.com/manage/s/article/K000162605
• CISA, Known Exploited Vulnerabilities catalog JSON: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• CERT-EU, Security Advisory 2026-013, September 22, 2026: https://cert.europa.eu/publications/security-advisories/2026-013/
• Field Effect, independent remediation analysis and hotfix matrix: https://fieldeffect.com/blog/f5-fixes-big-ip-apm-vulnerability