CVE-2026-94127: F5 BIG-IP APM Vulnerability Exploited

F5 disclosed CVE-2026-94127 on September 22, 2026, a vulnerability that operations teams dread: it has been exploited in the wild. This critical flaw resides within BIG-IP Access Policy Manager (APM) and is characterized as a heap-based buffer overflow. Rated a severe 9.8 under the CVSS v3.1 scoring system, it grants an unauthenticated remote attacker the ability to execute arbitrary code on the affected appliance. This article details the nature of the vulnerability, the specific configurations that render systems susceptible, and the necessary steps for remediation.

The Vulnerability Explained

CVE-2026-94127 impacts F5's BIG-IP Access Policy Manager (APM) module. The vulnerable code segment executes within the Traffic Management Microkernel (TMOS), which is the core data plane process responsible for handling network traffic. The exploit is triggered by sending specially crafted malicious traffic to a virtual server. Crucially, this virtual server must have both an APM access policy and an OAuth profile configured. The vulnerability bypasses authentication, meaning an attacker does not need any credentials to initiate an attack. Successful exploitation leads to remote code execution (RCE) on the BIG-IP appliance.

The heap-based buffer overflow occurs when APM processes an OAuth token that is improperly handled. If the token exceeds the allocated buffer size, it can overwrite adjacent memory regions on the heap. This overwrite can corrupt critical data structures or redirect program execution flow, allowing an attacker to inject and run their own malicious code. This code could then be used to gain a persistent foothold on the network, exfiltrate sensitive data, or launch further attacks against internal systems.

Affected Configurations and Systems

The severity of CVE-2026-94127 is amplified by the specific configurations that enable it. Not all BIG-IP deployments are vulnerable. The vulnerability is present only in BIG-IP systems that meet the following criteria:

• The BIG-IP system must have the Access Policy Manager (APM) module licensed and provisioned.
• The affected BIG-IP system must be configured with a virtual server that utilizes an APM access policy.
• Additionally, this virtual server must have an OAuth profile configured.

F5 has identified specific versions of BIG-IP that are affected. These include:

• BIG-IP versions 17.0.0
• BIG-IP versions 16.1.0 through 16.1.3
• BIG-IP versions 15.1.0 through 15.1.8
• BIG-IP versions 14.1.0 through 14.1.5

It is imperative for administrators to check their current BIG-IP versions and configurations. A system might be running an affected version but not be vulnerable if it does not have APM and an OAuth profile configured on any virtual servers. Conversely, a system might have APM but not be vulnerable if no virtual servers use both APM and an OAuth profile.

Mitigation and Remediation Steps

Given that the vulnerability has been exploited, immediate action is crucial. F5 has released hotfixes for the affected BIG-IP versions. Organizations that cannot immediately apply these hotfixes have an interim mitigation option using an iRule. However, F5 strongly advises that the iRule is a temporary measure and should be replaced with a hotfix as soon as possible.

Applying Hotfixes

The recommended and most secure solution is to upgrade to a fixed version. F5 has provided updated versions that address CVE-2026-94127. Administrators should consult the official F5 security advisory for the exact hotfix versions and download links relevant to their specific BIG-IP release.

The specific fixed versions are:

• BIG-IP 17.0.0: 17.0.0.3
• BIG-IP 16.1.0 - 16.1.3: 16.1.3.4
• BIG-IP 15.1.0 - 15.1.8: 15.1.8.3
• BIG-IP 14.1.0 - 14.1.5: 14.1.5.5

Emergency iRule Mitigation

For environments where an immediate upgrade is not feasible, F5 offers an emergency iRule. This iRule inspects incoming traffic for patterns indicative of the exploit attempt and blocks it. While effective as a temporary measure, iRules can introduce performance overhead and may not catch all variations of an attack. Therefore, it should not be considered a permanent solution.

The iRule works by identifying requests that contain specific OAuth-related parameters within the HTTP headers or URI that are characteristic of the exploit. If such a pattern is detected, the iRule will terminate the connection, preventing the vulnerability from being triggered.

Administrators can implement this iRule by navigating to Local Traffic > iRules and creating a new iRule with the provided F5 script. This iRule should then be applied to the affected virtual servers that use both APM and an OAuth profile. It is critical to test iRules in a non-production environment before deploying them to live systems to avoid unintended disruptions.

Broader Implications and Recommendations

The exploitation of CVE-2026-94127 underscores the critical importance of promptly patching network infrastructure, especially devices that act as entry points for user authentication and access control. BIG-IP APM, often deployed at the network edge, is a prime target for attackers seeking to gain initial access.

Organizations should review their security posture regarding F5 BIG-IP devices. This includes:

• Maintaining an accurate inventory of all BIG-IP devices and their configurations.
• Regularly monitoring F5 security advisories and applying patches and hotfixes without delay.
• Implementing a robust vulnerability management program that prioritizes critical vulnerabilities, particularly those with active exploits.
• Ensuring that access control policies, including authentication and authorization mechanisms, are hardened and regularly audited.

The fact that this vulnerability allows unauthenticated remote code execution is particularly concerning. It means that an attacker can compromise the appliance without needing any prior knowledge of the system's users or credentials. This attack vector bypasses traditional perimeter defenses that rely on authentication for protection.

For security professionals, this event serves as a stark reminder that even complex, enterprise-grade security appliances can harbor critical flaws. Continuous vigilance, proactive patching, and a layered security approach are essential to defend against sophisticated threats. If you manage F5 BIG-IP APM, consider this your immediate call to action: check your versions, assess your configurations, and apply the necessary fixes.