Table of contents
19
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: CVE-2026-94127 is an unauthenticated remote code execution bug in F5 BIG-IP APM, and attackers were using it before F5 had a fix.
- Only one setup is affected. APM must be acting as an OAuth Authorization Server, with an access policy and an OAuth profile on the same virtual server. APM used only as an OAuth client or resource server is not affected.
- Attackers got there first. F5 says it learned the flaw “has been exploited.” It scores 9.8 on CVSS 3.1 and needs no login.
- The federal deadline is tomorrow. CISA added CVE-2026-94127 to its exploited list on September 22 and gave agencies until September 25, three days, plus a forensic check.
- Your management-port lockdown does not help. F5 calls this a data plane issue. The vulnerable path is the virtual server your clients already reach.
- Patch, then hunt. The fix is an engineering hotfix. If you ran the vulnerable setup while it was exposed, look for signs of compromise before you call it closed.
Most critical bugs hit everyone who runs the product. This one only hits people who turned on one specific feature, and that is what makes it easy to miss.
CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager, the part of BIG-IP that handles logins, single sign-on and token issuing for a lot of large organizations. It sits at the edge of the network, which is exactly where an attacker wants a remote code execution bug to be.
Here is what F5 has said, what it has not, and how to check your own boxes today.
BIG-IP is F5’s appliance and software line for load balancing and application delivery. APM (Access Policy Manager) is a module on top of it. It decides who gets in: it shows the logon page, checks the user, and applies policy before traffic reaches the application behind it.
APM can also act as an OAuth 2.0 authorization server. In that role it issues authorization codes, access tokens and refresh tokens, and it can check tokens on request. Plenty of companies use it to put a single login in front of mobile apps, partner APIs and internal tools.
Two things make a bug here serious. The device is usually reachable from the internet on purpose, because clients have to log in. And it holds the keys: session data, tokens and often credentials for everything behind it.
F5 published advisory K000162605 on September 22, 2026. The description, as recorded in NVD, reads:
“When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server.”
The same record adds that an unauthenticated attacker can do this, that a BIG-IP in Appliance mode is also vulnerable, and that it is “a data plane issue; there is no control plane exposure.”
The details in short:
F5 itself has not published the vulnerable function or the exact request that triggers it. A third-party research team has since reverse-engineered and published both, which we cover in its own section below.
Here is the part most headlines skip. CVE-2026-94127 is not “BIG-IP APM is vulnerable.” It is “BIG-IP APM is vulnerable if it is an OAuth authorization server.”
F5’s documentation for APM as an OAuth server shows how that setup is built:
That virtual server then answers the authorization server endpoints: authorize, token issuance, token revocation and token introspection, plus the OpenID Connect and key endpoints if you enable them.
APM used the other way round, as an OAuth client or resource server that only checks tokens from someone else’s server, is not affected. F5 also documents that running both roles on one box takes two virtual servers, so an organization can have APM in both roles and only one of them is the risk.
Most BIG-IP advice of the last few years comes down to one line: do not expose the management interface. That was the right advice for older bugs, and it is why F5’s own note stands out here.
F5 says CVE-2026-94127 is “a data plane issue; there is no control plane exposure.” The data plane is the traffic path, run by the TMM (Traffic Management Microkernel) process. The attack goes to the virtual server, not to the management port.
That leaves you with a hard fact. An OAuth authorization server is meant to be reachable by its clients, and clients are often on the internet. So the thing that has to be open for the service to work is the same thing the bug lives behind. That is our reading of F5’s wording, and it is why hiding the admin interface will not protect you from CVE-2026-94127.
Two more details from the advisory are easy to miss:
Here is the record, checked against CISA’s own catalog file:
| Date | What happened |
|---|---|
| Sep 20, 2026 | CVE ID reserved (F5’s CVE record) |
| Sep 22, 2026 | F5 advisory K000162605 and CVE published |
| Sep 22, 2026 | CISA adds CVE-2026-94127 to KEV |
| Sep 25, 2026 | CISA’s deadline for federal agencies |
CISA’s KEV entry is named “F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability.” Its record on NVD carries CISA’s own triage: exploitation active, automatable yes, technical impact total. Those are the three answers you never want to see together.
The deadline is short because of CISA’s BOD 26-04, issued June 10, 2026. For a publicly exposed asset where an exploit gives full control and can be automated, agencies get three days and must also run a forensic triage of the asset to see whether it was compromised. The KEV entry is flagged for exactly that. CISA’s note even says to apply F5’s iRule first, so the triage can happen safely, and install the final patch afterwards.
What is not known, as of today:
If someone tells you they know who is behind CVE-2026-94127, they know more than F5, CISA and every vendor we read.
On September 23, 2026, watchTowr Labs published a technical analysis of CVE-2026-94127 by researcher Sina Kheirkhah. It is not F5’s own advisory, and F5 still has not published these details itself, but it is the most detailed public account we have found, and it changes some of what we said above.
The trigger. watchTowr configured an OAuth profile on a test BIG-IP and sent a request to the OAuth userinfo endpoint, /f5-oauth2/v1/userinfo, with an Authorization header larger than 0x4100 bytes, about 16.6 KB. In the code they analyzed, TMM allocates a fixed 0x4100-byte heap buffer for a userinfo request and, before the fix, copies the header into it with no check that the header fits. Anything longer overflows the buffer.
watchTowr’s diff of the patched build shows the CVE-2026-94127 fix is a size check: the patched code tests whether the header is larger than 0x4100 bytes and, if so, returns the error “Authorization header too big” before the copy runs. The unpatched code has no such test.
From crash to code execution. watchTowr says it got lucky with the heap layout: in about 90% of its runs, an object holding a function pointer landed just past the overflowed buffer, and TMM later calls that pointer. Overwriting it, together with a stack pivot and a chain of code that already exists in the binary, gave the researchers control of execution in their lab. They also note that BIG-IP has address randomization and no executable heap or stack, but no position-independent executable.
Two more system protections shaped what they could do next. SELinux blocked their first attempt, a direct call to run a shell command, with a plain permission error. Instead, they found a script the appliance itself runs automatically every time TMM crashes, /etc/bigstart/scripts/tmm.finish, and used their code-execution primitive to append a command to that file rather than run one directly. Because the same bug crashes TMM to trigger it, the crash they caused was also what ran their planted command.
Read this for what it is: one research team’s detailed account of CVE-2026-94127, not a public exploit tool. watchTowr did not publish ready-to-run exploit code, and we have not reproduced any part of this ourselves. Nothing here changes the fix for CVE-2026-94127: install the hotfix, or use the iRule mitigation in the meantime.
F5’s version list is short. The affected builds are:
| Branch | Affected | Fixed in |
|---|---|---|
| 21.1 | 21.1.0 | Hotfix-BIGIP-21.1.0.2.0.30.22-ENG |
| 17.5 | 17.5.0 to 17.5.1 | Hotfix-BIGIP-17.5.1.9.0.160.12-ENG |
| 17.1 | 17.1.0 to 17.1.3 | Hotfix-BIGIP-17.1.3.5.0.41.14-ENG |
Go in this order. Each step can end the search early:
Only step 5 is the exposure. If you get there, treat the box as vulnerable until the hotfix is on it.
One honest limit: as far as we can tell, F5 has published no way to fingerprint a vulnerable system from outside. The answer lives in the device’s configuration, so someone has to look inside.
F5’s advisory lists three indicators and says the combination is what matters. As BleepingComputer quotes F5, look for “a combination of multiple OAuth authentication failures and suspicious commands, shortly followed by a TMM SIGABRT.”
F5’s advisory page loads only in a browser, so we could not read it directly. The specifics below come from The Hacker News and Cyber Security News, who summarized it. Confirm them against K000162605 before you build detections.
/var/log/apm. The command tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed should show an unexplained jump in total_failed./var/log/audit that line up in time with those failures./etc/bigstart/scripts/tmm.finish, the script BIG-IP itself runs every time TMM crashes. watchTowr’s write-up describes using exactly this file as a foothold. Its absence does not rule out a different technique.
A crash is a likely side effect of a heap overflow. It is not guaranteed. Our reading is that a quiet log is not proof of a clean box, especially if the attacker got the memory layout right the first time.
If any indicator shows up, F5’s advice is a full investigation: administrative activity, configuration changes, accounts, running processes, scheduled tasks and outbound connections. Do not stop at the patch.
Related reading: the same edge-device pattern shows up in CVE-2026-8452 on Citrix NetScaler and CVE-2026-76460 on Cisco ISE. Our OAuth and SSO testing guide covers the login flows this feature is built to serve.
CVE-2026-94127 is not the first exploited remote code execution flaw in BIG-IP APM this year. CISA added CVE-2025-53521 to KEV on March 27. BleepingComputer reports that F5 first called it a denial-of-service bug and later re-rated it as critical remote code execution.
In September, Sophos and ESET described what attackers dropped on devices hit through that earlier bug: a Linux rootkit ESET calls PoisonedRefresh. According to Help Net Security, it hides a web shell in memory instead of on disk, so file checks look clean. BleepingComputer adds that it survives BIG-IP upgrade images.
To be clear: no source connects PoisonedRefresh to CVE-2026-94127. We are not saying it is the same actor or the same tool. We are saying it is a live example of what patient attackers do after they get code execution on an APM box. It is also why “we patched” and “we are clean” are two different statements.
One more piece of context. In October 2025, F5 disclosed that a nation-state attacker had stolen BIG-IP source code and information about undisclosed vulnerabilities, according to Help Net Security. Nothing published ties that incident to CVE-2026-94127, and we are not implying it does. It just explains why security teams watch BIG-IP disclosures closely.
We will be plain about limits. watchTowr has now published how CVE-2026-94127 works, and we are not going to point that at a BIG-IP we have not been authorized to test, or tell you we did. The honest work is around the bug, not through it.
That work is where most teams have gaps. It is finding every BIG-IP you actually run, including the ones nobody put in the asset list. It is reading the real configuration to see which virtual servers combine an OAuth profile and an access policy, and who can reach them. It is checking that the hotfix really landed, on both members of an HA pair. And it is a proper look at the logs and the box itself for the indicators above.
That is the kind of testing our human testers and AI agents run on edge infrastructure, and your data stays on your own machine while we do it.
CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager that allows an unauthenticated attacker to run code on the device. It only exists when APM is set up as an OAuth Authorization Server, with an access policy and an OAuth profile on the same virtual server.
Yes. F5 says it learned the flaw “has been exploited,” and CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog on September 22, 2026. CISA’s own triage marks exploitation as active and automatable.
F5 lists 17.1.0 through 17.1.3, 17.5.0 through 17.5.1, and 21.1.0. Versions past End of Technical Support are not evaluated, so an older branch is unknown rather than safe. Ask F5 if you run one.
Install the engineering hotfix for your branch: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. If you cannot patch right away, open a ticket with F5 support for the iRule mitigation, then install the hotfix.
No. F5 says deployments using APM strictly as an OAuth client or resource server, without OAuth authorization server profiles configured, are not affected by CVE-2026-94127.
Look for the combination F5 describes: repeated OAuth authentication failures, suspicious commands, then a TMM SIGABRT crash. Check /var/log/apm, /var/log/audit and TMM core files. A crash alone does not prove compromise, and its absence does not prove safety.
CVE-2026-94127 punishes a specific choice: turning APM into an OAuth authorization server and putting it where clients can reach it. If you never made that choice, you are fine. If you did, you are on the wrong side of an exploited, unauthenticated code execution bug, and the fix is a hotfix, not a setting.
Do the five checks today, patch the boxes that fail them, and hunt before you close the ticket. The federal deadline for CVE-2026-94127 is tomorrow. Yours should not be later.
Categories
Related articles
