CVE-2026-94127: F5 BIG-IP APM RCE Under Active Exploitation

F5 has released emergency engineering hotfixes for CVE-2026-94127, a critical heap-based buffer overflow in BIG-IP Access Policy Manager (APM). The vulnerability allows an unauthenticated attacker to execute code when an APM access policy and an OAuth profile are configured on the same virtual server.

F5 has confirmed exploitation in the wild. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 22, 2026, with a federal remediation deadline of September 25, 2026. Organizations using BIG-IP APM as an OAuth authorization server should identify affected virtual servers, preserve evidence, and apply the appropriate hotfix immediately.

What Is CVE-2026-94127?

CVE-2026-94127 is a heap-based buffer overflow rated 9.8 under CVSS v3.1 and 9.3 under CVSS v4.0. A specially crafted request can reach the vulnerable OAuth processing path before authentication and result in remote code execution.

The issue affects the BIG-IP data plane. F5 states that systems operating in Appliance mode are also vulnerable, but the vulnerability does not directly expose the control plane. Successful exploitation could still compromise the traffic-processing layer that enforces access decisions for protected applications.

Which BIG-IP Configurations Are Vulnerable?

Version alone does not determine exposure. A system is affected when the same virtual server has both an APM access policy and an OAuth profile. F5 specifies that the vulnerable path applies when APM functions as an OAuth authorization server; deployments using only the OAuth client or resource-server role are outside the documented condition.

F5 did not evaluate releases that had reached the end of technical support. An older branch being absent from the table should therefore not be interpreted as confirmation that it is safe. Unsupported deployments should be moved to a supported, fixed release. Confirm applicability against F5 Security Advisory K000162605.

How Urgent Is the Risk?

The risk is immediate because exploitation preceded or coincided with public disclosure. F5 says the vulnerability has been exploited, while CISA requires covered federal agencies to remediate it within three days under BOD 26-04. CISA also requires forensic triage and lists ransomware use as unknown, so the KEV entry should not be presented as confirmed ransomware activity.

The exposure condition narrows the affected population, but it does not reduce the impact for systems that meet it. BIG-IP APM often sits in front of sensitive applications and authentication flows. Code execution at that boundary can create risk for access policies, session material, credentials, tokens, and downstream services that trust the appliance.

What Should Defenders Look For?

F5’s guidance focuses on a sequence of behavioral indicators rather than a fixed list of attacker IP addresses or file hashes. Defenders should correlate the following signs around the same time window:

• Repeated OAuth failures. Review /var/log/apm for rapid or high-volume failed UserInfo requests, particularly the message indicating that an access token is invalid.
• An unexplained rise in failed requests. Check OAuth statistics for unusual growth in total_failed relative to normal traffic.
• Unexpected command activity. Review /var/log/audit around suspicious OAuth events for commands or administrative actions that do not match approved work.
• TMM crashes or core files. Investigate TMM SIGABRT events and related files under /var/core. A core file alone is not proof of exploitation, but it becomes more significant when it follows OAuth failures and suspicious commands.

Preserve relevant logs, core files, configuration data, and timing information before making changes when operationally possible. If the indicators align, treat the appliance as potentially compromised rather than assuming that installing the hotfix completes incident response.

What Should Defenders Do Now?

• Identify exposed configurations. Find virtual servers where an APM access policy and OAuth authorization-server profile are configured together.
• Preserve evidence. Collect the relevant APM, audit, and system logs and investigate recent activity before normal log rotation removes useful context.
• Apply the correct engineering hotfix. Match the deployed release to F5’s hotfix and confirm the running build after installation.
• Use F5’s iRule only as temporary mitigation. Request the vendor-provided iRule from F5 Support when immediate patching is not possible; it does not replace the hotfix.
• Investigate downstream trust. If compromise is suspected, review protected applications, privileged sessions, OAuth tokens, credentials, and integrations that may have been reachable from the appliance.
• Restrict administrative access. Keep management interfaces limited to trusted networks as a general control, while recognizing that this vulnerability targets the data plane.

How Can SOCRadar Support Prioritization?

SOCRadar Vulnerability Intelligence can help teams track CVE-2026-94127, KEV status, vendor updates, and changes in exploitation evidence. External Attack Surface Management can help identify internet-facing BIG-IP services and prioritize systems whose configuration and business role require immediate validation.

Exposure data should be combined with configuration review and appliance telemetry. An internet-facing BIG-IP system is not necessarily vulnerable to this flaw, while an internally reachable system that meets the OAuth authorization-server condition may still require urgent remediation.

Conclusion

CVE-2026-94127 is an actively exploited, unauthenticated RCE vulnerability with a specific configuration requirement: an APM access policy and OAuth profile must share a virtual server. Organizations should use that condition to identify affected systems quickly, then preserve evidence and install the correct engineering hotfix.

Where suspicious OAuth failures, command activity, and TMM crashes appear together, remediation should expand beyond patching to incident response and review of the applications and credentials that trusted the affected appliance.