- Published on
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers
- Authors
- Name
- DeepHorus
F5 has issued an urgent patch for a critical zero-day vulnerability in its BIG-IP Access Policy Manager that attackers are already exploiting to execute code remotely without authentication. Tracked as CVE-2026-94127, the flaw was disclosed in an advisory on September 22, alongside engineering hotfixes for affected software branches. The flaw matters because it hands attackers unauthenticated remote code execution on network appliances that sit in front of enterprise applications and traffic. F5 has confirmed active exploitation but has not disclosed the number of compromised systems. Federal agencies have been given only days to respond.
APM is the BIG-IP module governing how users reach an organization's applications and networks. The vulnerable configuration exists when an APM access policy and an OAuth authorization server profile share the same virtual server, which hosts the address receiving OAuth traffic. In that setup, specially crafted traffic sent to the virtual server triggers a heap-based buffer overflow. F5 rates the issue 9.8 out of 10 on CVSS v3.1 and 9.3 on CVSS v4.0. The flaw applies only where APM issues access tokens as an OAuth authorization server.
Because the malicious traffic targets the virtual server itself, restricting access to the BIG-IP management interface does not mitigate the risk, and systems running in Appliance mode remain vulnerable. F5 updated its CVE record at 00:45 UTC on September 23 to narrow the condition to the authorization server role only. The U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog entry and a CERT-EU advisory for EU institutions had already been published, describing the condition more broadly as an access policy plus an OAuth profile on a virtual server. Systems using APM purely as an OAuth client or resource server are unaffected, while versions at End of Technical Support were not evaluated and therefore have an unknown status.
CISA added CVE-2026-94127 to the KEV catalog on September 22 and set a September 25 deadline for federal civilian agencies to apply F5's mitigations. Neither F5's CVE record nor CISA's KEV entry identifies the attackers, the targeted organizations, or the number of systems compromised. The advisory also notes that an earlier APM flaw, CVE-2025-53521, entered the KEV catalog in March, and that its fixes for the 17.1 and 17.5 branches fall inside the currently affected ranges. A system running build 17.1.3 or 17.5.1.3 still requires the new hotfix if APM operates as an OAuth authorization server.
F5's recommended remedy is the engineering hotfix listed for each branch; where immediate installation is impossible, the company provides an iRule mitigation for the affected virtual server, requested through an F5 support ticket. CERT-EU advises preserving forensic evidence first, applying the hotfix, scanning for compromise signs, and initiating incident response if any appear. CISA instructed agencies to deploy the iRule first to allow proactive forensic triage, then install the final vendor patch as soon as possible.
F5's indicators of compromise include repeated failed UserInfo requests in /var/log/apm carrying the error "The access token is invalid," particularly 10 or more from a single IP address in a short window. An unexplained rise in total_failed, checked via tmctl global_oauth_stat, is a second signal. When those failures are followed by suspicious commands and a TMM SIGABRT shortly afterward, human review of the system is warranted. F5's guidance points organizations toward immediate hotfix installation and continuous log monitoring while attackers remain active.
