A severe zero-day vulnerability in F5’s BIG-IP Access Policy Manager (APM) is under attack in the wild and enables remote code execution on affected systems without requiring authentication. Tracked as CVE-2026-94127 and identified internally by F5 as issue 2524777, it stems from a heap-based buffer overflow in virtual servers configured with both an APM access policy and an OAuth Authorization Server profile. The disclosure comes via advisory K000162605, published September 22, 2026.
What’s at stake and who’s affected
The flaw allows specially crafted network traffic to corrupt memory in the data plane—the part of the system that handles application traffic—leading to potential arbitrary code execution. Importantly, the issue does not arise in setups where APM is used merely as an OAuth Client or Resource Server; only deployments where it acts as an OAuth Authorization Server are vulnerable.
Among the Big-IP Big-IP versions confirmed as vulnerable are APM 21.1.0; 17.5.0 through 17.5.1; and 17.1.0 through 17.1.3. Other modules like BIG-IQ, F5OS variants, F5 AI Gateway, NGINX products, BIG-IP Next, and F5’s distributed cloud services were evaluated and found not to be affected. However, systems beyond end-of-support versions weren’t comprehensively assessed, so absence from the affected version list doesn’t guarantee safety.
Urgent mitigation and detection steps
F5 has released hotfixes for each affected branch: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG for 21.1.0; Hotfix-BIGIP-17.5.1.9.0.160.12-ENG for 17.5.x; and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG for 17.1.x. Administrators are urged to inventory virtual servers, identify whether they combine access-policy with OAuth-Authorization Server profiles, and apply the appropriate hotfix immediately. Where patching isn’t immediately feasible, F5 suggests using a compensating iRule.
Detection guidance includes monitoring for three correlated events: increased OAuth authentication failures; unexpected command execution; and occurrences of Traffic Management Microkernel (TMM) SIGABRT events. ● Check `/var/log/apm` for clusters of invalid-token messages, particularly if from a single IP. ● Use `tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed` to track failed OAuth token and userinfo request rates. Correlate those with audit log timestamps. ● Be cautious if a TMM core file appears during a SIGABRT event—or if authentication failures and SIGABRTs occur close together in time; while any single indicator isn’t definitive, the combination raises serious concern.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog, reflecting that attacks are already underway. The scale of exploitation, attacker identity, and intent post-exploit remain unconfirmed.
For defenders, preserving all relevant logs and conducting retrospective hunts for signs of exploitation are as crucial as patching. Prioritize systems operating as OAuth Authorization Servers for remediation and forensic review. Indicators include frequent invalid-token failures, suspicious commands, and TMM instability.
Analytical take: This vulnerability re-underscores how complex service configurations—especially where multiple roles like APM and OAuth authorization are combined—can harbor severe risk. Enterprises must not just focus on applying patches but rigorously map their BIG-IP deployments’ configurations. Moving forward, expect further scrutiny on appliance-mode and data-plane flaws in other vendor tools, with threats shifting from traditional control-plane vulnerabilities to novel attack surfaces in the data path.
