F5 Patches Critical BIG-IP APM Zero-Day Allowing Unauthenticated RCE

F5 has reported active exploitation of a critical vulnerability in the Access Policy Manager (APM) module for BIG-IP. The flaw lets an attacker run arbitrary code on a device without logging in.

What it is

The vulnerability, tracked as CVE-2026-94127, is a heap-based buffer overflow. F5 rates it 9.8 out of 10 on CVSS v3.1 and 9.3 on CVSS v4.0. It was disclosed on September 22 alongside an advisory and the release of engineering hotfixes.

Not every configuration is at risk — only those where APM serves as an OAuth authorization server, issuing access tokens to applications. The vulnerable setup looks like this: a single virtual server has both an APM access policy and an OAuth authorization server profile. Specially crafted traffic sent to that virtual server leads to code execution. Systems that use APM only as an OAuth client or resource server are not affected.

Why isolation won't help

Because the malicious traffic goes to the virtual server itself, restricting access to the BIG-IP management interface offers no protection. Systems running in Appliance mode are vulnerable too.

The U.S. agency CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on September 22 and ordered federal civilian agencies to apply mitigations by September 25. Neither F5's record nor CISA's data reveals how many systems were attacked, who is behind the campaign, or which organizations were targeted.

The wording has been a source of confusion. At 00:45 UTC on September 23, F5 clarified that the flaw appears only in the authorization server role. The CISA and CERT-EU advisories came out earlier and describe the condition more broadly — as an access policy plus any OAuth profile on a virtual server.

What to do now

The primary fix is the engineering hotfixes for the affected branches (21.1, 17.5 and 17.1). If they can't be installed immediately, F5 offers a temporary iRule mitigation, available by opening a support ticket. CISA advises applying the iRule first "to allow for proactive forensic triage," then installing the vendor patch as soon as possible. CERT-EU recommends preserving forensic evidence before anything else.

Indicators of compromise per F5: repeated failed UserInfo requests in APM logs with the error "The access token is invalid" (especially ten or more from one IP in a short window), an unexplained rise in the total_failed counter, suspicious commands in the audit log, and a subsequent SIGABRT crash of the TMM process. None of F5, CISA or CERT-EU say whether installing the hotfix removes access an attacker may have already gained.

Source: The Hacker News