CVE-2026-94127 is an unauthenticated heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM) that leads to remote code execution. It is reachable only on virtual servers where APM acts as an OAuth Authorization Server. F5 published advisory K000162605 and NVD published the record on September 22, 2026. F5's advisory states that "this vulnerability has been exploited," which makes this a zero-day at disclosure. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a due date of September 25 and a forensic triage requirement attached.
F5 SIRT scores it 9.8 under CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 under CVSS v4.0. The fixes ship as engineering hotfixes, not maintenance releases. The advisory also says to check for compromise before remediating.
Am I vulnerable?
Affected versions
| Product |
Vulnerable range |
| BIG-IP APM 21.x |
21.1.0 before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG |
| BIG-IP APM 17.5.x |
17.5.0 through 17.5.1 before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG |
| BIG-IP APM 17.1.x |
17.1.0 through 17.1.3 before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG |
A system is exposed when three conditions hold: it runs an affected version, APM is provisioned, and at least one virtual server carries both an APM access policy and an OAuth profile with APM acting as the Authorization Server. F5 states that APM used only as an OAuth Client or Resource Server is not affected. The flaw sits on the data plane, so the management interface is not the attack surface. Appliance mode does not protect a system. BIG-IQ, BIG-IP Next, NGINX, F5OS and F5 Distributed Cloud are out of scope. F5 did not evaluate versions past End of Technical Support, so treat those as exposed.
Diagnostic commands
All read-only:
- Version and hotfix level:
tmsh show sys version. Vulnerable if the version is in a range above and the Build/Edition does not show the branch's engineering hotfix.
- APM provisioning:
tmsh list sys provision apm. If the level is nominal, minimum or dedicated, APM is provisioned. If it is none, this CVE does not apply.
- Exposed virtual servers:
tmsh list ltm virtual profiles. Look for any virtual server that lists both an APM access profile and an OAuth profile. Then confirm whether that OAuth configuration acts as an authorization server.
- Compromise triage (not an exposure check):
tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed. Compare total_failed with your baseline. An unexplained rise calls for the incident-response steps in the Detection section.
Vulnerability
NVD classifies the flaw as CWE-122, heap-based buffer overflow. F5's description is brief: "When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution." The overflow happens in the Traffic Management Microkernel (TMM) while it handles OAuth requests addressed to APM in its Authorization Server role. The attacker needs no credentials and no user interaction.
F5 has not published the vulnerable function or the request shape. As of September 23, no public exploit code appears in the repositories CVE Brief tracks, and no watchTowr, GreyNoise, Mandiant, Tenable or CrowdStrike technical analysis has been published.
The public detail comes from F5's compromise indicators, relayed by CERT-EU (Security Advisory 2026-013), BleepingComputer and Field Effect. The observed sequence is:
- Repeated OAuth authentication failures from a single source in
/var/log/apm.
- Suspicious commands in
/var/log/audit.
- Shortly afterwards, a TMM SIGABRT that leaves a core file.
This fits memory corruption that the attacker triggers repeatedly until it succeeds, with the traffic process crashing afterwards. CERT-EU sets the triage threshold at ten or more OAuth errors from one IP in a short window, and advises preserving forensic evidence before applying the hotfix.
CISA's SSVC assessment in the NVD record reads exploitation active, automatable yes, technical impact total. BleepingComputer cites Shadowserver tracking about 14,700 internet-exposed BIG-IP IP addresses. That figure counts BIG-IP exposure in general, not confirmed Authorization Server configurations, so the vulnerable population is smaller and not publicly measured.
Threat model
- Who would exploit this: No public source has named an actor, and no attribution appears here. By category, state-aligned espionage operators fit the early evidence best. The first exploitation was a zero-day against a narrow configuration, and CISA Emergency Directive 26-01 records that a nation-state-affiliated actor stole part of the BIG-IP source code and vulnerability information from F5 in 2025. Nothing public ties that theft to this CVE. Initial-access brokers and ransomware affiliates become the concern if exploit details circulate: CISA advisory AA22-138A documents broad exploitation of CVE-2022-1388 once proofs of concept were public. CISA lists ransomware use as unknown.
- What they're after:
- A persistent foothold on an edge authentication appliance, where endpoint tooling rarely runs
- Identity material: OAuth token-signing keys, client secrets, directory bind credentials and live session tokens
- A pivot onto internal VLANs from the appliance's trusted network position
- Decrypted traffic, because TLS terminates on the BIG-IP
- Access that can be resold or handed to ransomware operators if exploitation broadens
- Attack chain: An unauthenticated attacker sends crafted OAuth traffic to a virtual server where APM acts as the Authorization Server. This overflows a heap buffer and gives the attacker code execution on the data plane. The failures, commands and crash in F5's indicators match that sequence. From there the attacker can collect keys and credentials stored on the device and reach systems behind it through its internal interfaces.
- Blast radius: An Authorization Server holds the keys that sign the tokens it issues. If those keys are stolen, an attacker can forge tokens that every relying application accepts. The device also holds AD, LDAP or RADIUS service credentials, TLS private keys for the applications it fronts, and active user sessions. A hotfix does not undo a compromise that has already happened. If an exposed system ran unpatched before the hotfix or the F5 iRule was applied, treat all of that material as possibly exposed.
Mitigation
Patch
| Branch |
Fixed build |
Hotfix |
| 21.1.0 |
21.1.0.2.0.30.22 |
Hotfix-BIGIP-21.1.0.2.0.30.22-ENG |
| 17.5.x |
17.5.1.9.0.160.12 |
Hotfix-BIGIP-17.5.1.9.0.160.12-ENG |
| 17.1.x |
17.1.3.5.0.41.14 |
Hotfix-BIGIP-17.1.3.5.0.41.14-ENG |
These are engineering hotfixes delivered through F5 Support. No maintenance release containing the fix had been announced as of September 23. Follow CERT-EU's advice and collect forensic evidence (the qkview, /var/log/apm, /var/log/audit, /var/log/ltm and any TMM core files) before installing, because the upgrade reboots the system and can overwrite what you need.
Configuration mitigation
F5 provides a mitigation iRule for the affected virtual servers. It is not published in the advisory and must be requested from F5 Support. CISA's KEV entry describes it as a temporary measure that allows forensic triage before the final patch. CVE Brief does not reproduce or reconstruct it. Use the version F5 supplies.
Compensating controls
- Remove the OAuth Authorization Server role from any virtual server that does not need it. Client-only and Resource-Server-only configurations are not affected.
- Restrict source addresses for OAuth authorization endpoints when your clients come from known networks, such as partner ranges or internal applications.
- Send
/var/log/apm, /var/log/audit and /var/log/ltm off-box to your SIEM, so an attacker with root on the appliance cannot erase the evidence.
- Egress-filter the BIG-IP's self IPs and management interface. The appliance should not start arbitrary outbound connections.
- If you find signs of compromise, rotate OAuth signing keys and client secrets, directory bind credentials and TLS keys held on the device, and invalidate active sessions.
Detection (starter rules: validate before deploying)
These rules are AI-generated starter content. Test against your own telemetry and tune falsepositives before deploying to production.
Network and log signals
- In
/var/log/apm, ten or more OAuth invalid-token or authentication-failure messages from a single source IP within a short window, against a virtual server with an Authorization Server profile. This is the threshold from F5 and CERT-EU.
- A TMM SIGABRT or restart soon after that burst: a
sod-initiated TMM abort in /var/log/ltm, plus a new TMM core file under /var/core or /shared/core with a matching timestamp.
- Entries in
/var/log/audit (user creation, sshd allow-list changes, file writes) whose timing lines up with the OAuth failures and the TMM crash. F5 says the three signals together warrant human review.
- An unexplained rise in
total_failed from tmctl global_oauth_stat.
- Outbound connections that the BIG-IP itself starts from its self or management IPs to unfamiliar hosts after a TMM restart.
- New or changed files in
/tmp, /var/tmp, /shared or /config/filestore, new cron entries, or new local admin accounts that do not match change records.
YARA
rule CVEBrief_BIGIP_Appliance_Webshell_Or_Dropper_Generic
{
meta:
description = "Generic heuristic for scripts or webshells dropped into writable BIG-IP locations after appliance compromise. Not CVE-specific."
author = "CVE Brief"
date = "2026-09-23"
reference = "https://my.f5.com/manage/s/article/K000162605"
warning = "AI-generated starter rule, validate in your environment before deploying"
scope = "Scan /tmp /var/tmp /shared /config/filestore on BIG-IP"
strings:
$php_exec1 = "system($_" ascii nocase
$php_exec2 = "passthru($_" ascii nocase
$php_exec3 = "shell_exec($_" ascii nocase
$php_eval = /eval\s*\(\s*(base64_decode|gzinflate|str_rot13)\s*\(/ ascii nocase
$jsp_exec = "Runtime.getRuntime().exec(request.getParameter" ascii
$sh_rev1 = "/dev/tcp/" ascii
$sh_rev2 = /\bnc(at)?\s+(-e|-c)\s+\/bin\/(ba)?sh/ ascii
$py_rev = /socket\.socket\(.{0,80}subprocess/ ascii
$tmsh_user = /tmsh\s+(create|modify)\s+auth\s+user\s+\S+.{0,120}role\s+admin/ ascii nocase
$tmsh_ssh = /tmsh\s+modify\s+sys\s+sshd\s+allow/ ascii nocase
$cron = /(crontab\s+-|\/etc\/cron\.d\/).{0,120}(curl|wget)\s/ ascii
condition:
filesize < 2MB and
(
any of ($php_exec*, $php_eval, $jsp_exec) or
($sh_rev1 and ($sh_rev2 or $py_rev)) or
any of ($tmsh_user, $tmsh_ssh) or
$cron
)
}
Sigma
title: Suspicious Child Process of F5 BIG-IP TMM or APM Daemon
id: 3f6c2a9e-8b41-4d27-9c5e-1a7d0e4b6f23
status: experimental
description: Detects a shell, downloader, interpreter or network utility spawned by the BIG-IP Traffic Management Microkernel (tmm) or the APM daemon (apmd). Neither process launches these in normal operation. The pattern is consistent with post-exploitation of an APM OAuth memory-corruption RCE such as CVE-2026-94127. AI-generated starter rule, validate before deploying.
references:
- https://my.f5.com/manage/s/article/K000162605
- https://cert.europa.eu/publications/security-advisories/2026-013/
author: CVE Brief
date: 2026/09/23
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
- cve.2026-94127
logsource:
product: linux
category: process_creation
detection:
selection_parent:
ParentImage|endswith:
- '/tmm'
- '/tmm64'
- '/apmd'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/curl'
- '/wget'
- '/python'
- '/python3'
- '/perl'
- '/nc'
- '/ncat'
- '/socat'
- '/base64'
- '/openssl'
condition: selection_parent and selection_child
falsepositives:
- F5 support or diagnostic tooling launched under a traffic daemon (not expected; confirm with F5 before suppressing)
- Differences in tmm binary naming across BIG-IP versions may require adjusting ParentImage
level: high
Rule notes
The log signals follow F5's and CERT-EU's compromise indicators. F5 has not published exact log strings, so the Sigma rule watches for TMM or apmd starting a shell or tool, which is a behaviour rather than a signature. Confirm on each BIG-IP version that process-creation telemetry (for example, auditd) is available and that the TMM binary name matches. The YARA rule is a general check for webshells and persistence on the appliance, not a detection for this CVE, and it has not been compiled against a live system.
References