# CVE-2026-94127: Critical F5 BIG-IP APM Zero-Day Heap Overflow in OAuth Authorization Server Exploited for Unauthenticated Remote Code Execution

> CVE-2026-94127 is a pre-authentication heap-based buffer overflow (CWE-122) in the Traffic Management Microkernel (TMM) data plane of F5 BIG-IP Access Policy Manager (APM) 21.1.0, 17.5.0-17.5.1 and 17.1.0-17.1.3 that yields remote code execution when a virtual server carries both an APM access policy and an OAuth Authorization Server profile. F5 (K000162605) confirmed in-the-wild zero-day exploitation on 2026-09-22 and shipped engineering hotfixes plus a temporary iRule; CISA added it to KEV the same day with a 2026-09-25 federal remediation deadline.

- **Published:** 2026-09-23T00:00:00Z
- **Last reviewed:** 2026-09-28T00:43:58.553Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2632
- **ID:** TL-2026-2632
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-94127

## Description

On 22 September 2026 F5 published security advisory K000162605 (internal tracking ID 2524777) disclosing CVE-2026-94127, a critical heap-based buffer overflow (CWE-122) in BIG-IP Access Policy Manager (APM). F5 stated it had learned the vulnerability was already being exploited in the wild, making it a true zero-day at disclosure. CISA added the flaw to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-22 as "F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability" (alongside two Check Point flaws and an Arista VeloCloud Orchestrator flaw) and ordered FCEB agencies to remediate by 2026-09-25, a 72-hour window; CISA's SSVC assessment records exploitation as active, the flaw as automatable, and technical impact as total. CERT-EU issued Security Advisory 2026-013 the same day (16:52 UTC) urging evidence preservation, hotfix installation and compromise assessment.

Vulnerable configuration: the flaw is reachable only when a BIG-IP virtual server has BOTH an APM access policy AND an OAuth profile in which APM operates as an OAuth Authorization Server (issuing access tokens to applications). Deployments that use APM strictly as an OAuth Client or Resource Server, without an OAuth authorization server profile, are not affected. Systems running in Appliance mode remain vulnerable when the affected configuration is present. Affected releases are BIG-IP APM 21.1.0, 17.5.0-17.5.1 and 17.1.0-17.1.3. BIG-IP Next, BIG-IQ Centralized Management, F5 Distributed Cloud services, F5OS, NGINX products and F5 AI Gateway are not affected. Because the bug lives in the data plane, restricting access to the BIG-IP management interface does not protect against it (The Hacker News).

Exploit mechanics: F5 characterises this as a data-plane issue in the Traffic Management Microkernel (TMM) with no control-plane exposure. An unauthenticated attacker with network access to an affected virtual server sends specially crafted traffic to the OAuth Authorization Server configuration; the heap overflow corrupts TMM memory during request handling and can be steered into arbitrary code execution on the appliance. No authentication or user interaction is required and attack complexity is low (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N = 9.3). Secondary analysis (Decryption Digest) describes the trigger as a single crafted HTTP request carrying malformed or oversized OAuth parameters that TMM's OAuth token-processing code copies into a fixed-size heap buffer without length validation, before any authentication check completes, overwriting adjacent heap metadata; F5 has not publicly confirmed the exact vulnerable parser. Exploitation can drive TMM into a loop, at which point the SOD (failover/watchdog) daemon sends TMM a SIGABRT (signal 6), producing a TMM core file and interrupting all traffic handled by the data plane.

Post-exploitation exposure: code execution inside TMM places the attacker in-line with everything the appliance brokers. Decryption Digest notes that a compromised APM gives access to all traffic flowing through the appliance, SSL/TLS inspection keys, active VPN sessions and credentials in transit, the ability to forge or revoke OAuth tokens issued by the compromised authorization server, and direct network adjacency to internal resources. F5's indicators show attackers running commands on the host after successful exploitation, and SOC Prime additionally advises watching for new or unexplained outbound connections from the appliance, unexpected processes or files appearing after suspicious OAuth activity, and configuration changes without a corresponding administrator action.

Indicators of compromise (behavioural - F5 published no IP, domain or hash IOCs): (1) repeated failed OAuth UserInfo requests in /var/log/apm with the error description "The access token is invalid" (CERT-EU log pattern: "err tmm1[...]: 01990004:3: <PROFILE_NAME>: Request UserInfo from Source ID (null) IP <IP> failed") - ten or more related failures, especially from a single source IP within a short period, warrant analysis; (2) an unexplained increase in the OAuth failure counters, checked with `tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed`; (3) suspicious command activity recorded in /var/log/audit; (4) TMM core files in /var/core/ indicating a SIGABRT. F5's guidance is that the combination of multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT should trigger human review.

Exposure and context: Shadowserver tracks more than 14,700 IP addresses exposing BIG-IP APM fingerprints (Network World cites more than 15,000, roughly 5,000 each in North America and Europe), although these counts do not indicate how many run the vulnerable OAuth AS configuration or remain unpatched. No public proof-of-concept had been identified at publication, and F5 has not disclosed the threat actor, victim count, targeted industries or post-compromise objectives. BleepingComputer notes eight F5 vulnerabilities have been listed by CISA as exploited since November 2021, four of them in ransomware attacks, and that state-sponsored hackers breached F5 in August 2025 and stole undisclosed BIG-IP source code. The disclosure also lands weeks after reporting (Help Net Security, BleepingComputer, 2026-09-09) on a Linux rootkit (tracked by ESET as PoisonedRefresh) deployed on BIG-IP APM devices breached through the earlier APM RCE CVE-2025-53521 that serves poisoned in-memory APM webtop PHP files plus a hidden UNIX-socket bash shell; there is no public evidence linking that campaign to CVE-2026-94127, but it demonstrates sustained adversary interest in APM identity gateways, which terminate TLS and handle SSO tokens and credentials for downstream applications.

Remediation: install the engineering hotfix for the running branch (Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, Hotfix-BIGIP-17.1.3.5.0.41.14-ENG or later). Where immediate patching is impossible, apply the temporary mitigating iRule available from F5 Support to each affected APM virtual server. CERT-EU and SOC Prime stress preserving forensic evidence (logs, TMM core files, plus upstream firewall, IDS/IPS, NetFlow, DNS and authentication telemetry) before patching and performing compromise assessment; it is not documented whether the hotfix removes access an attacker already obtained, so indicators of compromise must trigger full incident response, including rotation of keys, certificates and OAuth signing material held on the appliance.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1587.004 Develop Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1078 Valid Accounts
- T1606 Forge Web Credentials
- T1552.004 Unsecured Credentials: Private Keys
- T1040 Network Sniffing
- T1071 Application Layer Protocol
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1588.005 Obtain Capabilities: Exploits
- T1106 Native API
- T1068 Exploitation for Privilege Escalation
- T1037.004 Boot or Logon Initialization Scripts: RC Scripts
- T1546 Event Triggered Execution
- T1211 Exploitation for Stealth
- T1592.002 Gather Victim Host Information: Software
- T1595.001 Active Scanning: Scanning IP Blocks
- T1588.006 Obtain Capabilities: Vulnerabilities

## Sources

- [F5 K000162605: BIG-IP APM vulnerability CVE-2026-94127](https://my.f5.com/manage/s/article/K000162605)
- [NVD - CVE-2026-94127](https://nvd.nist.gov/vuln/detail/CVE-2026-94127)
- [CISA Adds Four Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog)
- [CISA KEV Catalog entry - CVE-2026-94127](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127)
- [CERT-EU Security Advisory 2026-013: Critical Vulnerability in F5 BIG-IP APM](https://cert.europa.eu/publications/security-advisories/2026-013/)
- [CVE-2026-94127: Critical F5 BIG-IP APM Zero-Day Exploited for Remote Code Execution (SOC Prime)](https://socprime.com/blog/cve-2026-94127-analysis/)
- [Rapid7 ETR: CVE-2026-94127 Critical Unauthenticated RCE in F5 BIG-IP APM](https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm)
- [Rapid7 Vulnerability DB - CVE-2026-94127](https://www.rapid7.com/db/vulnerabilities/cve-2026-94127/)
- [F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/f5-warns-of-big-ip-apm-remote-code-execution-zero-day-exploited-in-attacks/)
- [F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers (The Hacker News)](https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html)
- [Hackers Exploiting F5 BIG-IP OAuth Server 0-day Flaw to Gain Remote Code Execution (Cyber Security News)](https://cybersecuritynews.com/f5-big-ip-oauth-server-0-day-flaw/)
- [F5 fixes actively exploited zero-day flaw in BIG-IP APM (Network World)](https://www.networkworld.com/article/4225726/f5-fixes-actively-exploited-zero-day-flaw-in-big-ip-apm-2.html)
- [F5 BIG-IP APM Zero-Day Exploited in Zero-Day RCE Attacks (Security Affairs)](https://securityaffairs.com/199619/security/f5-big-ip-apm-zero-day-exploited-in-zero-day-rce-attacks.html)
- [Critical F5 BIG-IP Vulnerability Exploited as Zero-Day (SecurityWeek)](https://www.securityweek.com/critical-f5-big-ip-vulnerability-exploited-as-zero-day/)
- [F5 Fixes Actively Exploited BIG-IP APM Vulnerability (Field Effect)](https://fieldeffect.com/blog/f5-fixes-big-ip-apm-vulnerability)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2632