Zerodayhub

TL;DR — F5 is warning that CVE-2026-94127, a heap-based buffer overflow (CWE-122) in BIG-IP Access Policy Manager (APM), is being exploited in the wild and was added to CISA’s Known Exploited Vulnerabilities catalog on 22 September 2026 with a federal patch deadline of 25 September 2026. Rated CVSS 9.8 (Critical) under v3.1 and 9.3 under v4.0, it lets an unauthenticated remote attacker run arbitrary code by sending crafted traffic to a BIG-IP virtual server configured as an OAuth authorization server. Only that specific configuration is affected – but where it is exposed to the internet, this is a pre-auth takeover of the box that fronts your applications. Patch to the engineering hotfixes now and treat any exposed, unpatched OAuth server as potentially compromised.

What Is the F5 BIG-IP APM OAuth Flaw (CVE-2026-94127)?

BIG-IP is F5’s application delivery and security platform – the load-balancing, reverse-proxy and access-control appliance that sits at the edge of a great many enterprise and government networks. Access Policy Manager (APM) is the module that handles authentication and access policy, and it can act as an OAuth 2.0 authorization server, issuing and validating tokens for the applications behind it. CVE-2026-94127 lives in that OAuth authorization-server code path.

The flaw is a heap-based buffer overflow (CWE-122). Malicious traffic sent to a virtual server that has both an access policy and an OAuth authorization-server profile bound to it can overflow a buffer on the heap and, from there, be driven to remote code execution without any authentication. F5 is explicit about the precondition: deployments where APM is only an OAuth client or resource server – not the authorization server – are not affected. That narrows the blast radius, but the authorization-server role is common wherever APM is used for single sign-on, so plenty of production estates qualify.

F5 published its advisory (K000162605) and engineering hotfixes on 22 September 2026, disclosing at the same time that the flaw was already under active attack. Because the vulnerable component is the internet-facing access gateway itself, this is the kind of edge-device bug that attackers prize: exploit it and you are inside the security control, not merely past it.

How the CVE-2026-94127 Exploit Works

In plain terms: an attacker who can reach the login/OAuth front door of a BIG-IP APM – which, by design, is reachable without logging in – sends a specially crafted request that makes the OAuth handler write more data into a heap buffer than it was sized for. That overflow corrupts neighbouring data structures on the heap, and with careful shaping it is turned into control over what the appliance executes.

The mechanism, per F5’s advisory: the vulnerability is a heap-based buffer overflow (CWE-122) reachable through the OAuth authorization-server functionality of APM. Crafted traffic to a virtual server that binds both an access policy and an OAuth authorization-server profile triggers the overflow. Because the OAuth authorization endpoint is exposed before a user authenticates, no credentials are required – the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, no privileges and no user interaction, with high impact to confidentiality, integrity and availability. F5 has not published the precise offset, the vulnerable field or an exploit chain, and ZeroDayHub is not publishing one either. The defensively useful facts are the affected configuration, the fixed builds and the detection guidance below.

# Triage: is this BIG-IP actually in the vulnerable configuration?
# 1. Is a version in an affected branch running?  (21.1.0 / 17.5.0-17.5.1 / 17.1.0-17.1.3)
tmsh show sys version

# 2. Is any virtual server bound to BOTH an access policy AND an
#    OAuth authorization-server (OAuth AS) profile?  Those are the exposed ones.
tmsh list apm profile access
tmsh list apm aaa oauth-server
tmsh list ltm virtual one-line | grep -i oauth

# 3. Hunt for signals of exploitation of an OAuth AS virtual server:
#    - APM/TMM core dumps or restarts around unusual OAuth requests
#    - malformed OAuth authorize/token requests from unexpected sources
#    - new/unexpected files or processes on the appliance

Impact Nuance: Critical, but Gated by One Configuration

The scary number is real: an unauthenticated, network-reachable RCE on an edge access gateway earns its CVSS 9.8. But two qualifiers decide whether a given BIG-IP is actually in the firing line. First, the box must be running an affected branch – F5 lists 21.1.0, 17.5.0–17.5.1 and 17.1.0–17.1.3. Second, and more importantly, a virtual server must be configured as an OAuth authorization server (an access policy plus an OAuth AS profile on the same virtual server). APM deployments that use OAuth only as a client or resource server, or that don’t use the OAuth AS role at all, are not exploitable via this path.

That gating is why some feeds initially carried cautious language about exploitation. Treat the authoritative signals as the deciding ones: F5 states the flaw is being exploited and CISA has placed it on the KEV catalog – the bar for a KEV listing is reliable evidence of active exploitation. The v3.1 and v4.0 scores also differ (9.8 vs 9.3); both land firmly in Critical, so the practical takeaway is unchanged. The honest reading: if you run BIG-IP APM as an OAuth authorization server on an affected build and it is reachable from untrusted networks, this is a drop-everything patch; if you don’t use the OAuth AS role, you still patch on your normal cycle, but you can breathe.

When the vulnerable component is the access gateway itself, exploitation doesn’t get an attacker past your security control – it hands them the control.

Active Exploitation of CVE-2026-94127

F5 disclosed CVE-2026-94127 on 22 September 2026 already flagged as exploited in the wild, making it a zero-day at the point of publication rather than a theoretical risk. The same day, CISA added it to the Known Exploited Vulnerabilities catalog and set a federal civilian remediation deadline of 25 September 2026 under Binding Operational Directive 22-01 – a three-day window that signals how seriously the agency is treating an unauthenticated edge-device RCE.

As is normal at this stage, no public proof-of-concept and no named threat actor had been released at the time of writing, and F5 has not shared victim numbers or an exploit chain. History with F5 BIG-IP tells the rest of the story: pre-authentication flaws in internet-facing BIG-IP appliances are reverse-engineered from the patch quickly and followed by broad internet-wide scanning. The prudent assumption for any exposed, unpatched OAuth authorization server is that it is a target now – and possibly already compromised.

Remediation & Mitigation: Patching the BIG-IP APM OAuth Overflow

Install F5’s engineering hotfix for your branch. Per advisory K000162605, the fixes are:

• 21.1.0 → Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
• 17.5.0–17.5.1 → Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
• 17.1.0–17.1.3 → Hotfix-BIGIP-17.1.3.5.0.41.14-ENG

These are engineering hotfixes rather than full maintenance releases – apply the one F5 lists for your exact running version, and watch F5’s advisory for a rolled-up release that supersedes them. If you cannot patch immediately, reduce exposure in the meantime:

• Restrict access to the OAuth authorization server. Limit which networks can reach the affected virtual server – front it with an allow-list, VPN or upstream firewall so untrusted internet hosts cannot hit the OAuth endpoint while you schedule the hotfix.
• Remove the exposure if you don’t need it. If a virtual server has an OAuth authorization-server profile bound but the OAuth AS role isn’t actually in use, unbinding it removes the vulnerable path.
• Confirm your configuration. Use the triage commands above to establish whether any virtual server is actually acting as an OAuth authorization server on an affected build – that is the set that needs emergency handling.

If a BIG-IP APM was exposed and unpatched, assume it may be compromised. Code execution on the appliance means an attacker could read decrypted traffic, harvest session tokens and credentials, alter access policy and pivot into the internal applications the device fronts. After patching: rotate secrets stored on or reachable from the device (OAuth signing keys and client secrets, TLS private keys, admin and service credentials, API tokens), invalidate active sessions and issued tokens, review the APM and OAuth configuration for unauthorised changes, and hunt for TMM/APM core dumps, unexpected processes or files, and anomalous OAuth requests in the logs. Where compromise is confirmed, rebuild the device from a known-good image rather than cleaning in place.

Related ZeroDayHub Coverage

CVE-2026-94127 is the latest in a run of unauthenticated flaws in internet-facing access and delivery appliances – the class of bug that turns your perimeter into the attacker’s foothold. For a closely comparable memory-corruption bug in a rival ADC, see our write-up of the Citrix NetScaler memory overflow (CVE-2026-8452). And for another remote-access gateway taken over pre-authentication, read our coverage of the Check Point VPN authentication bypass (CVE-2026-50751). The recurring lesson: the device you bought to keep attackers out is, when it is vulnerable, the single most valuable thing for them to break.

Sources & Further Reading

• F5 – K000162605: BIG-IP APM vulnerability CVE-2026-94127 (advisory, affected versions, hotfixes)
• CVE.org – CVE-2026-94127 record
• NVD – CVE-2026-94127 detail (CVSS 9.8 v3.1, CWE-122)
• The Hacker News – F5 patches critical BIG-IP APM zero-day exploited for unauthenticated RCE on OAuth servers
• GBHackers – Critical F5 BIG-IP APM flaw actively exploited for remote code execution
• Field Effect – F5 fixes actively exploited BIG-IP APM vulnerability
• CISA – Known Exploited Vulnerabilities Catalog

ZeroDayHub reports on vulnerabilities for defensive purposes only. This article summarises the publicly-documented root cause and configuration but deliberately omits a working exploit while patching is in progress.