Threat reportVulnerabilityTL-2026-2632
CVE-2026-94127: Critical F5 BIG-IP APM Zero-Day Heap Overflow in OAuth Authorization Server Exploited for Unauthenticated Remote Code Execution
CVE-2026-94127 (TL-2026-2632), also tracked as F5 K000162605, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-09-23 and last reviewed 2026-09-28. It has no confirmed attribution, affects F5 BIG-IP Access Policy Manager (APM) - OAuth Authorization Server, references 1 CVE (CVE-2026-94127), maps to 19 MITRE ATT&CK techniques (T1037.004, T1040, T1059.004), and is covered by 9 detection rules and 21 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 19MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 21Indicators of compromise
Key facts for TL-2026-2632
- Threat ID
- TL-2026-2632
- Also known as
- F5 K000162605, F5 ID 2524777, F5 BIG-IP APM OAuth Authorization Server RCE, CERT-EU 2026-013
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, enterprise, technology
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 21
- Updates
- 2026-09-28 · 3 updates · revalidated 3× · latest source
How CVE-2026-94127 works
CVE-2026-94127 is a pre-authentication heap-based buffer overflow (CWE-122) in the Traffic Management Microkernel (TMM) data plane of F5 BIG-IP Access Policy Manager (APM) 21.1.0, 17.5.0-17.5.1 and 17.1.0-17.1.3 that yields remote code execution when a virtual server carries both an APM access policy and an OAuth Authorization Server profile. F5 (K000162605) confirmed in-the-wild zero-day exploitation on 2026-09-22 and shipped engineering hotfixes plus a temporary iRule; CISA added it to KEV the same day with a 2026-09-25 federal remediation deadline.
On 22 September 2026 F5 published security advisory K000162605 (internal tracking ID 2524777) disclosing CVE-2026-94127, a critical heap-based buffer overflow (CWE-122) in BIG-IP Access Policy Manager (APM). F5 stated it had learned the vulnerability was already being exploited in the wild, making it a true zero-day at disclosure. CISA added the flaw to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-22 as "F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability" (alongside two Check Point flaws and an Arista VeloCloud Orchestrator flaw) and ordered FCEB agencies to remediate by 2026-09-25, a 72-hour window; CISA's SSVC assessment records exploitation as active, the flaw as automatable, and technical impact as total. CERT-EU issued Security Advisory 2026-013 the same day (16:52 UTC) urging evidence preservation, hotfix installation and compromise assessment.
Vulnerable configuration: the flaw is reachable only when a BIG-IP virtual server has BOTH an APM access policy AND an OAuth profile in which APM operates as an OAuth Authorization Server (issuing access tokens to applications). Deployments that use APM strictly as an OAuth Client or Resource Server, without an OAuth authorization server profile, are not affected. Systems running in Appliance mode remain vulnerable when the affected configuration is present. Affected releases are BIG-IP APM 21.1.0, 17.5.0-17.5.1 and 17.1.0-17.1.3. BIG-IP Next, BIG-IQ Centralized Management, F5 Distributed Cloud services, F5OS, NGINX products and F5 AI Gateway are not affected. Because the bug lives in the data plane, restricting access to the BIG-IP management interface does not protect against it (The Hacker News).
Exploit mechanics: F5 characterises this as a data-plane issue in the Traffic Management Microkernel (TMM) with no control-plane exposure. An unauthenticated attacker with network access to an affected virtual server sends specially crafted traffic to the OAuth Authorization Server configuration; the heap overflow corrupts TMM memory during request handling and can be steered into arbitrary code execution on the appliance. No authentication or user interaction is required and attack complexity is low (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N = 9.3). Secondary analysis (Decryption Digest) describes the trigger as a single crafted HTTP request carrying malformed or oversized OAuth parameters that TMM's OAuth token-processing code copies into a fixed-size heap buffer without length validation, before any authentication check completes, overwriting adjacent heap metadata; F5 has not publicly confirmed the exact vulnerable parser. Exploitation can drive TMM into a loop, at which point the SOD (failover/watchdog) daemon sends TMM a SIGABRT (signal 6), producing a TMM core file and interrupting all traffic handled by the data plane.
Post-exploitation exposure: code execution inside TMM places the attacker in-line with everything the appliance brokers. Decryption Digest notes that a compromised APM gives access to all traffic flowing through the appliance, SSL/TLS inspection keys, active VPN sessions and credentials in transit, the ability to forge or revoke OAuth tokens issued by the compromised authorization server, and direct network adjacency to internal resources. F5's indicators show attackers running commands on the host after successful exploitation, and SOC Prime additionally advises watching for new or unexplained outbound connections from the appliance, unexpected processes or files appearing after suspicious OAuth activity, and configuration changes without a corresponding administrator action.
Indicators of compromise (behavioural - F5 published no IP, domain or hash IOCs): (1) repeated failed OAuth UserInfo requests in /var/log/apm with the error description "The access token is invalid" (CERT-EU log pattern: "err tmm1[...]: 01990004:3: <PROFILE_NAME>: Request UserInfo from Source ID (null) IP <IP> failed") - ten or more related failures, especially from a single source IP within a short period, warrant analysis; (2) an unexplained increase in the OAuth failure counters, checked with `tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed`; (3) suspicious command activity recorded in /var/log/audit; (4) TMM core files in /var/core/ indicating a SIGABRT. F5's guidance is that the combination of multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT should trigger human review.
Exposure and context: Shadowserver tracks more than 14,700 IP addresses exposing BIG-IP APM fingerprints (Network World cites more than 15,000, roughly 5,000 each in North America and Europe), although these counts do not indicate how many run the vulnerable OAuth AS configuration or remain unpatched. No public proof-of-concept had been identified at publication, and F5 has not disclosed the threat actor, victim count, targeted industries or post-compromise objectives. BleepingComputer notes eight F5 vulnerabilities have been listed by CISA as exploited since November 2021, four of them in ransomware attacks, and that state-sponsored hackers breached F5 in August 2025 and stole undisclosed BIG-IP source code. The disclosure also lands weeks after reporting (Help Net Security, BleepingComputer, 2026-09-09) on a Linux rootkit (tracked by ESET as PoisonedRefresh) deployed on BIG-IP APM devices breached through the earlier APM RCE CVE-2025-53521 that serves poisoned in-memory APM webtop PHP files plus a hidden UNIX-socket bash shell; there is no public evidence linking that campaign to CVE-2026-94127, but it demonstrates sustained adversary interest in APM identity gateways, which terminate TLS and handle SSO tokens and credentials for downstream applications.
Remediation: install the engineering hotfix for the running branch (Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, Hotfix-BIGIP-17.1.3.5.0.41.14-ENG or later). Where immediate patching is impossible, apply the temporary mitigating iRule available from F5 Support to each affected APM virtual server. CERT-EU and SOC Prime stress preserving forensic evidence (logs, TMM core files, plus upstream firewall, IDS/IPS, NetFlow, DNS and authentication telemetry) before patching and performing compromise assessment; it is not documented whether the hotfix removes access an attacker already obtained, so indicators of compromise must trigger full incident response, including rotation of keys, certificates and OAuth signing material held on the appliance.
MITRE ATT&CK techniques used in TL-2026-2632
Persistence
T1037.004 Boot or Logon Initialization Scripts: RC Scripts; T1078 Valid Accounts; T1546 Event Triggered Execution
Credential Access
T1040 Network Sniffing; T1552.004 Unsecured Credentials: Private Keys; T1606 Forge Web Credentials
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1106 Native API
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol
Initial Access
T1190 Exploit Public-Facing Application
Stealth
T1211 Exploitation for Stealth
Impact
T1499.004 Endpoint Denial of Service: Application or System Exploitation
Resource Development
T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities
Reconnaissance
T1592.002 Gather Victim Host Information: Software; T1595.001 Active Scanning: Scanning IP Blocks; T1595.002 Active Scanning: Vulnerability Scanning
Affected products and versions in CVE-2026-94127
- F5 — BIG-IP Access Policy Manager (APM) - OAuth Authorization Server configuration
Vulnerable versions: 21.1.0; 17.5.0-17.5.1; 17.1.0-17.1.3
Fixed in: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG; Hotfix-BIGIP-17.5.1.9.0.160.12-ENG; Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
Remediation for CVE-2026-94127
Patches
- BIG-IP APM 21.1.0: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG or later
- BIG-IP APM 17.5.0-17.5.1: Hotfix-BIGIP-17.5.1.9.0.160.12-ENG or later
- BIG-IP APM 17.1.0-17.1.3: Hotfix-BIGIP-17.1.3.5.0.41.14-ENG or later
- F5 advisory K000162605
Immediate actions
- Identify every BIG-IP virtual server that carries both an APM access policy and an OAuth Authorization Server profile (e.g. review 'tmsh list ltm virtual all-properties' output)
- Preserve forensic evidence before changes: /var/log/apm, /var/log/audit, /var/core TMM core files, plus upstream firewall, IDS/IPS, NetFlow, DNS and authentication telemetry
- Run 'tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed' and investigate unexplained growth in total_failed
- Hunt /var/log/apm for repeated 'Request UserInfo ... failed' (01990004:3) / 'The access token is invalid' entries (10+ from a single source IP in a short period)
- Review /var/log/audit for suspicious commands following OAuth failure bursts and check for TMM SIGABRT crashes sent by the SOD daemon
- Initiate incident response if indicators are present; treat the appliance, its SSL keys, OAuth signing material and the tokens/credentials it brokered as potentially compromised
- FCEB agencies: remediate by 2026-09-25 per CISA KEV and BOD 26-04
Workarounds
- Apply the temporary mitigating iRule obtained from F5 Support to each affected BIG-IP APM virtual server until the hotfix is installed
- Where operationally feasible, detach the OAuth Authorization Server profile from internet-facing APM virtual servers
- Note: restricting access to the management interface does NOT mitigate this data-plane flaw
Longer-term hardening
- Restrict network exposure of APM OAuth Authorization Server virtual servers to required client populations
- Forward BIG-IP APM, audit and TMM crash telemetry to the SIEM and alert on OAuth-failure-then-SIGABRT sequences
- Monitor for new or unexplained outbound connections, unexpected processes/files and unattributed configuration changes on BIG-IP appliances
- After any suspected compromise, rotate TLS private keys, OAuth token-signing keys and credentials that transited the appliance
- Track F5 quarterly security notifications for a final (non-ENG) fixed release and move off engineering hotfixes
CVEs associated with CVE-2026-94127
Weaknesses (CWE) in CVE-2026-94127
Timeline of CVE-2026-94127
- F5 internally discovers a nation-state actor (later named UNC5221, using the BRICKSTORM malware) had maintained long-term persistent access to its BIG-IP product-development and engineering knowledge-management environments (per F5's SEC 8-K filing date).
- F5 discloses that state-sponsored hackers (activity detected August 2025) breached its environment and stole undisclosed BIG-IP source code and vulnerability information - context for adversary zero-day development against BIG-IP (no confirmed link to CVE-2026-94127)
- CISA adds the related BIG-IP APM OAuth/access-policy vulnerability CVE-2025-53521 to its KEV catalog after F5 reclassifies it from a denial-of-service finding to remote code execution — the second of three BIG-IP APM pre-auth RCE-class flaws (after CVE-2023-46747) to reach KEV before CVE-2026-94127.
- Exploitation of Check Point Management Server (CVE-2026-93616) begins, the start of a broader wave of edge-security-appliance zero-day exploitation that CVE-2026-94127 and Arista VeloCloud Orchestrator (CVE-2026-93952) later join in the same September 2026 CISA KEV window.
- Help Net Security and BleepingComputer report a Linux rootkit (ESET: PoisonedRefresh) deployed on BIG-IP APM devices breached via the earlier APM RCE CVE-2025-53521, hiding a web shell in memory - establishes active adversary focus on APM gateways (no confirmed link to CVE-2026-94127)
- BleepingComputer reports the zero-day, noting Shadowserver tracks 14,700+ IPs with BIG-IP APM fingerprints and that eight F5 flaws have been CISA-listed as exploited since November 2021 (four in ransomware attacks)
- CERT-EU issues Security Advisory 2026-013 at 16:52 UTC with the 01990004:3 'Request UserInfo ... failed' log pattern, urging evidence preservation, hotfix installation and compromise assessment
- CISA adds CVE-2026-94127 to the KEV catalog (with two Check Point and one Arista VeloCloud flaw); SSVC: exploitation active, automatable, total technical impact
- CVE-2026-94127 published to NVD at 15:17 UTC with CNA f5sirt CVSS 3.1 9.8 / CVSS 4.0 9.3 and CWE-122
- F5 publishes advisory K000162605 (ID 2524777) disclosing CVE-2026-94127, confirms in-the-wild exploitation, and releases engineering hotfixes for 21.1.0, 17.5.x and 17.1.x plus a temporary iRule via F5 Support
- GovCERT.HK issues High Threat Security Alert A26-09-36 covering CVE-2026-94127 for Hong Kong organizations.
- watchTowr Labs publishes a patch-diff root-cause analysis of the tmm64 binary, identifying the missing Authorization-header length check (fixed with the log string 'Authorization header too big.') on the /f5-oauth2/v1/userinfo path, and classifying the flaw as CWE-680 (Integer Overflow to Buffer Overflow).
- Rapid7 publishes an Emergent Threat Response and ships checks in Exposure Command, InsightVM and Nexpose; SOC Prime and Decryption Digest publish behavioural detection guidance; Network World cites 15,000+ exposed APM deployments (~5,000 each in North America and Europe)
- F5 updates the CVE record at 00:45 UTC; NVD entry last modified 14:32 UTC
- Picus Security and SecPod publish exploit-chain reconstructions detailing the stack-pivot/ROP-chain mechanism via a corrupted callback pointer at buffer+0x4ff8; Picus catalogs the activity in its Threat Library as ID 97569, campaign "F5 Web Attack Campaign."
- CISA KEV remediation deadline for U.S. Federal Civilian Executive Branch agencies (apply vendor mitigations per BOD 26-04)
- watchTowr Labs publishes 'Is This A Joke? In The Auth Header?', a full technical breakdown of the heap-overflow-to-RCE exploit chain (including the tmm.finish SELinux-bypass step) together with working proof-of-concept exploit code, subsequently mirrored on public exploit-tracking indexes (Vulners/KitPloit, Sploitus); Picus Security and other vendors publish corroborating technical analyses.
Update history for TL-2026-2632
- 2026-09-28: What changed No field escalation — exploitability (ACTIVE), severity (CRITICAL), status (ACTIVE), attribution (Unattributed/LOW) all already at their evidenced ceiling and unchanged. The escalation is in public risk surface: weaponized PoC
- 2026-09-27 — CVE-2026-94127: F5 BIG-IP APM Heap-Based Buffer Overflow Enables Unauthenticated RCE, Exploited as Zero-Day: What changed No escalation — severity remains CRITICAL, exploitability ACTIVE, status ACTIVE, CVSS 9.8, attribution still LOW/Unattributed in both reports. New indicators (2) One new tool reference (Picus Threat Library ID 97569, "F5 Web At
- 2026-09-27 — F5 BIG-IP APM Unauthenticated Heap Overflow to RCE via OAuth Authorization Header (CVE-2026-94127): What changed No severity/exploitability/status/CVSS change (still CRITICAL / ACTIVE / ACTIVE / 9.8). Root cause and exploitation vector are now precisely known: an oversized Authorization Bearer header ( 16,640 bytes) to the /f5-oauth2/v1/u
Sources cited for CVE-2026-94127
- F5 K000162605: BIG-IP APM vulnerability CVE-2026-94127
- NVD - CVE-2026-94127
- CISA Adds Four Known Exploited Vulnerabilities to Catalog
- CISA KEV Catalog entry - CVE-2026-94127
- CERT-EU Security Advisory 2026-013: Critical Vulnerability in F5 BIG-IP APM
- CVE-2026-94127: Critical F5 BIG-IP APM Zero-Day Exploited for Remote Code Execution (SOC Prime)
- Rapid7 ETR: CVE-2026-94127 Critical Unauthenticated RCE in F5 BIG-IP APM
- Rapid7 Vulnerability DB - CVE-2026-94127
- F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks (BleepingComputer)
- F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers (The Hacker News)
- Hackers Exploiting F5 BIG-IP OAuth Server 0-day Flaw to Gain Remote Code Execution (Cyber Security News)
- F5 fixes actively exploited zero-day flaw in BIG-IP APM (Network World)
- F5 BIG-IP APM Zero-Day Exploited in Zero-Day RCE Attacks (Security Affairs)
- Critical F5 BIG-IP Vulnerability Exploited as Zero-Day (SecurityWeek)
- F5 Fixes Actively Exploited BIG-IP APM Vulnerability (Field Effect)
Detection coverage for TL-2026-2632
As of 2026-09-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2632 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.