On 22 September 2026 F5 published security advisory K000162605 (internal tracking ID 2524777) disclosing CVE-2026-94127, a critical heap-based buffer overflow (CWE-122) in BIG-IP Access Policy Manager (APM). F5 stated it had learned the vulnerability was already being exploited in the wild, making it a true zero-day at disclosure. CISA added the flaw to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-22 as "F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability" (alongside two Check Point flaws and an Arista VeloCloud Orchestrator flaw) and ordered FCEB agencies to remediate by 2026-09-25, a 72-hour window; CISA's SSVC assessment records exploitation as active, the flaw as automatable, and technical impact as total. CERT-EU issued Security Advisory 2026-013 the same day (16:52 UTC) urging evidence preservation, hotfix installation and compromise assessment.

Vulnerable configuration: the flaw is reachable only when a BIG-IP virtual server has BOTH an APM access policy AND an OAuth profile in which APM operates as an OAuth Authorization Server (issuing access tokens to applications). Deployments that use APM strictly as an OAuth Client or Resource Server, without an OAuth authorization server profile, are not affected. Systems running in Appliance mode remain vulnerable when the affected configuration is present. Affected releases are BIG-IP APM 21.1.0, 17.5.0-17.5.1 and 17.1.0-17.1.3. BIG-IP Next, BIG-IQ Centralized Management, F5 Distributed Cloud services, F5OS, NGINX products and F5 AI Gateway are not affected. Because the bug lives in the data plane, restricting access to the BIG-IP management interface does not protect against it (The Hacker News).

Exploit mechanics: F5 characterises this as a data-plane issue in the Traffic Management Microkernel (TMM) with no control-plane exposure. An unauthenticated attacker with network access to an affected virtual server sends specially crafted traffic to the OAuth Authorization Server configuration; the heap overflow corrupts TMM memory during request handling and can be steered into arbitrary code execution on the appliance. No authentication or user interaction is required and attack complexity is low (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N = 9.3). Secondary analysis (Decryption Digest) describes the trigger as a single crafted HTTP request carrying malformed or oversized OAuth parameters that TMM's OAuth token-processing code copies into a fixed-size heap buffer without length validation, before any authentication check completes, overwriting adjacent heap metadata; F5 has not publicly confirmed the exact vulnerable parser. Exploitation can drive TMM into a loop, at which point the SOD (failover/watchdog) daemon sends TMM a SIGABRT (signal 6), producing a TMM core file and interrupting all traffic handled by the data plane.

Post-exploitation exposure: code execution inside TMM places the attacker in-line with everything the appliance brokers. Decryption Digest notes that a compromised APM gives access to all traffic flowing through the appliance, SSL/TLS inspection keys, active VPN sessions and credentials in transit, the ability to forge or revoke OAuth tokens issued by the compromised authorization server, and direct network adjacency to internal resources. F5's indicators show attackers running commands on the host after successful exploitation, and SOC Prime additionally advises watching for new or unexplained outbound connections from the appliance, unexpected processes or files appearing after suspicious OAuth activity, and configuration changes without a corresponding administrator action.

Indicators of compromise (behavioural - F5 published no IP, domain or hash IOCs): (1) repeated failed OAuth UserInfo requests in /var/log/apm with the error description "The access token is invalid" (CERT-EU log pattern: "err tmm1[...]: 01990004:3: <PROFILE_NAME>: Request UserInfo from Source ID (null) IP <IP> failed") - ten or more related failures, especially from a single source IP within a short period, warrant analysis; (2) an unexplained increase in the OAuth failure counters, checked with `tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed`; (3) suspicious command activity recorded in /var/log/audit; (4) TMM core files in /var/core/ indicating a SIGABRT. F5's guidance is that the combination of multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT should trigger human review.

Exposure and context: Shadowserver tracks more than 14,700 IP addresses exposing BIG-IP APM fingerprints (Network World cites more than 15,000, roughly 5,000 each in North America and Europe), although these counts do not indicate how many run the vulnerable OAuth AS configuration or remain unpatched. No public proof-of-concept had been identified at publication, and F5 has not disclosed the threat actor, victim count, targeted industries or post-compromise objectives. BleepingComputer notes eight F5 vulnerabilities have been listed by CISA as exploited since November 2021, four of them in ransomware attacks, and that state-sponsored hackers breached F5 in August 2025 and stole undisclosed BIG-IP source code. The disclosure also lands weeks after reporting (Help Net Security, BleepingComputer, 2026-09-09) on a Linux rootkit (tracked by ESET as PoisonedRefresh) deployed on BIG-IP APM devices breached through the earlier APM RCE CVE-2025-53521 that serves poisoned in-memory APM webtop PHP files plus a hidden UNIX-socket bash shell; there is no public evidence linking that campaign to CVE-2026-94127, but it demonstrates sustained adversary interest in APM identity gateways, which terminate TLS and handle SSO tokens and credentials for downstream applications.

Remediation: install the engineering hotfix for the running branch (Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, Hotfix-BIGIP-17.1.3.5.0.41.14-ENG or later). Where immediate patching is impossible, apply the temporary mitigating iRule available from F5 Support to each affected APM virtual server. CERT-EU and SOC Prime stress preserving forensic evidence (logs, TMM core files, plus upstream firewall, IDS/IPS, NetFlow, DNS and authentication telemetry) before patching and performing compromise assessment; it is not documented whether the hotfix removes access an attacker already obtained, so indicators of compromise must trigger full incident response, including rotation of keys, certificates and OAuth signing material held on the appliance.