Security Intelligence
Loading table of contents...
At a glance:
-
F5 addressed an actively exploited vulnerability affecting specific BIG-IP Access Policy Manager deployments, by releasing engineering hotfixes for affected versions.
-
The vulnerability affects virtual servers configured with both an APM access policy and an OAuth profile, a deployment commonly used to provide OAuth-based authentication, single sign-on, and federated identity services.
-
Successful exploitation can result in unauthenticated remote code execution, making internet-facing authentication gateways the highest-priority systems for review and remediation.
Threat summary
On September 22, 2026, F5 addressed an actively exploited vulnerability affecting specific BIG-IP Access Policy Manager (APM) deployments by releasing engineering hotfixes for the affected versions:
- BIG-IP APM 21.x: 21.1.0. (Fixed in: Hotfix-BIGIP-21.1.0.2.0.30.22)
- BIG-IP APM 17.5.x: 17.5.0 through 17.5.1 (Fixed in: Hotfix-BIGIP-17.5.1.9.0.160.12)
- BIG-IP APM 17.1.x: 17.1.0 through 17.1.3 (Fixed in: Hotfix-BIGIP-17.1.3.5.0.41.14)
BIG-IP APM is an access management platform that organizations use to provide secure access to applications, web portals, virtual private network (VPN) services, and other protected resources. APM commonly sits between users and applications, where it evaluates authentication requests and enforces access policies before allowing connections to proceed. Many organizations use APM alongside identity providers and single sign-on services to centralize authentication and access controls.
The flaw is tracked as CVE-2026-94127, and affects virtual servers configured with both an APM access policy and an OAuth profile. Organizations commonly deploy this configuration when BIG-IP acts as an authentication gateway for applications that use OAuth-based authentication, single sign-on, or federated identity services. In these environments, the OAuth profile processes authentication requests while the APM access policy determines whether access is granted.
OAuth profiles allow BIG-IP to process authorization and identity-related requests, while APM access policies evaluate those requests and determine the actions that follow. F5 identified a heap-based buffer overflow in this processing path. Specially crafted traffic sent to an affected virtual server can corrupt memory during request handling.
The vulnerable functionality is reached when crafted OAuth-related traffic is processed by a virtual server using the affected configuration. F5 states that successful exploitation can result in unauthenticated remote code execution on the BIG-IP system. Exploitation is remote, requires no authentication, and does not require user interaction. CVE-2026-94127 was rated with a CVSS v3.1 score of 9.8.
F5 advisory includes indicators associated with observed attacks, including repeated OAuth authentication failures, suspicious command activity, and subsequent Traffic Management Microkernel (TMM) crash events. The advisory does not describe the exploitation process or explain how these events relate to each stage of exploitation.
Analysis
The vulnerable functionality is directly reachable over the network when a virtual server is configured with both an APM access policy and an OAuth profile. Organizations operating internet-facing BIG-IP APM deployments are the most exposed, particularly where BIG-IP acts as the authentication gateway for business applications, remote access services, or identity platforms. Because exploitation requires a specific OAuth-enabled configuration, defenders can narrow their investigation and remediation efforts to virtual servers using both an APM access policy and an OAuth profile.
F5 states that successful exploitation can result in unauthenticated remote code execution and has reported exploitation in the wild. The publicly available information does not describe the reliability or technical requirements of exploitation.
Threat actors regularly target authentication and access management infrastructure because these systems sit at a critical control point within enterprise environments. APM systems often process authentication traffic for multiple applications and user populations, making them attractive targets for obtaining a foothold on infrastructure that controls access to business services.
A compromised gateway could provide opportunities to disrupt authentication services, modify traffic flowing through the device, access information available to the affected process, or support additional activity against connected systems. These outcomes depend on the role of the appliance within the environment and have not been publicly linked to the exploitation activity reported by F5.
Mitigations
-
Review BIG-IP APM virtual servers configured with both an APM access policy and an OAuth profile to identify systems exposed to CVE-2026-94127.
-
Upgrade affected systems to the engineering hotfix released for the applicable BIG-IP version to eliminate the vulnerability. F5 released engineering hotfixes for all affected supported branches as the primary remediation for CVE-2026-94127.
- Apply F5's iRule mitigation where immediate deployment of the engineering hotfix is not possible. The iRule, available through F5 Support, is intended to reduce exposure while patching activities are completed.
- Review affected systems for the indicators published by F5, including repeated OAuth authentication failures, suspicious command activity, and TMM crash events occurring within a similar timeframe.
- If evidence of compromise is identified, perform a full incident response investigation. Review administrative activity, configuration changes, local accounts, running processes, scheduled tasks, and outbound network connections to determine the scope of activity.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
