When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server

CVE-2026-94127 is a heap-based buffer overflow (CWE-122) in the F5 BIG-IP Access Policy Manager (APM) OAuth Authorization Server profile processing path. When a virtual server is configured with both an APM access policy and an OAuth profile operating as an Authorization Server, the OAuth handling logic writes attacker-controlled data into a heap allocation without validating input size. The overrun corrupts adjacent heap memory, and a skilled attacker can manipulate the corrupted region to hijack control flow inside the Traffic Management Microkernel (TMM), converting the memory corruption into unauthenticated remote code execution. Affected versions are BIG-IP 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3. Deployments using APM only as an OAuth Client or Resource Server — without an OAuth Authorization Server profile — are not affected. This is a data-plane vulnerability; restricting the management interface or enabling Appliance mode provides no protection.

F5's CRITICAL / 9.8 rating is accurate and, if anything, conservative given the real-world context. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly reflects that this is an unauthenticated, low-complexity, network-reachable RCE with full CIA impact. F5 confirmed active exploitation as a zero-day before patches were available, and CISA immediately added it to the KEV catalog on September 22 with a 3-day remediation deadline for federal agencies. Shadowserver tracks over 14,700 IP addresses with BIG-IP APM fingerprints on the public internet. BIG-IP APM sits at the network perimeter as an authentication gateway — a compromised appliance exposes every application routed through it, making this one of the most dangerous CVEs disclosed this quarter.

1. Apply F5 iRule mitigation immediately — Contact F5 Support to obtain the specific iRule for CVE-2026-94127 and apply it to every virtual server with an APM access policy and OAuth profile. This is F5's recommended temporary mitigation for organizations that cannot install the hotfix within hours. The iRule blocks the malicious input pattern at the data plane. Deploy within hours — this is an actively exploited zero-day; the noisgate mitigation SLA for CRITICAL is ≤3 days, but active exploitation means you should treat this as *hours, not days*.
2. Install engineering hotfixes on all affected BIG-IP instances — Apply Hotfix-BIGIP-21.1.0.2.0.30.22-ENG (21.1.x), Hotfix-BIGIP-17.5.1.9.0.160.12-ENG (17.5.x), or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG (17.1.x) as appropriate. These are engineering hotfixes, not full upgrades — test in a maintenance window but prioritize speed. The noisgate remediation SLA for CRITICAL is ≤90 days, but given active exploitation, compress this to the earliest available change window.
3. Audit all BIG-IP APM instances for OAuth Authorization Server profiles — Run tmsh list apm profile oauth-server across your fleet to identify which BIG-IPs are actually vulnerable. Only instances with an OAuth Authorization Server profile on a virtual server with an APM access policy are affected. This scoping exercise lets you prioritize hotfix deployment on the highest-risk subset.
4. Hunt for indicators of compromise on exposed instances — Review /var/log/apm for 10+ invalid-token messages in rapid succession, check /var/log/ltm for TMM SIGABRT events, and look for suspicious commands or unauthorized configuration changes. Correlate these three indicators — their combined appearance signals exploitation. Any previously exposed, unpatched appliance should be treated as potentially compromised and undergo forensic triage before or during patching.
5. Place a WAF or IPS in front of BIG-IP OAuth endpoints — If you have an upstream WAF or IPS, deploy rules to inspect and limit OAuth parameter sizes on requests to /f5-oauth2/v1/authorize and /f5-oauth2/v1/token endpoints. This adds defense-in-depth but should NOT be treated as a substitute for the iRule or hotfix — the WAF may not catch all exploit variants.
6. Restrict network access to OAuth endpoints where feasible — If your OAuth Authorization Server endpoints do not need to be globally reachable, restrict source IPs using ACLs or firewall rules to known identity provider or client application ranges. This reduces the attack surface but may not be feasible for public-facing SSO deployments.

Run this script on each BIG-IP appliance (SSH as root or admin with tmsh access). Invoke with: bash check_cve_2026_94127.sh. Requires root or tmsh-capable user privileges.

#!/bin/bash
# check_cve_2026_94127.sh — CVE-2026-94127 BIG-IP APM OAuth RCE checker
# Run on the BIG-IP appliance itself as root or admin.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

# --- 1. Get BIG-IP version ---
if ! command -v tmsh &>/dev/null; then
  echo "UNKNOWN — tmsh not found. Is this a BIG-IP appliance?"
  exit 2
fi

VERSION=$(tmsh show sys version | grep -oP 'Version\s+\K[0-9]+\.[0-9]+\.[0-9]+'| head -1)
BUILD=$(tmsh show sys version | grep -oP 'Build\s+\K[0-9]+\.[0-9]+\.[0-9]+'| head -1)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not determine BIG-IP version."
  exit 2
fi

echo "Detected BIG-IP version: $VERSION (build: ${BUILD:-unknown})"

# --- 2. Check if APM is provisioned ---
APM_PROV=$(tmsh list sys provision apm 2>/dev/null | grep -c 'level nominal\|level minimum\|level dedicated' || true)
if [ "$APM_PROV" -eq 0 ]; then
  echo "PATCHED — APM is not provisioned. CVE-2026-94127 does not apply."
  exit 0
fi
echo "APM is provisioned."

# --- 3. Check for OAuth Authorization Server profiles ---
OAUTH_PROFILES=$(tmsh list apm profile oauth-server 2>/dev/null | grep -c 'apm profile oauth-server' || true)
if [ "$OAUTH_PROFILES" -eq 0 ]; then
  echo "PATCHED — No OAuth Authorization Server profiles found. CVE-2026-94127 does not apply."
  exit 0
fi
echo "Found $OAUTH_PROFILES OAuth Authorization Server profile(s)."

# --- 4. Check version against affected ranges ---
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

VULNERABLE=false

# 21.1.0
if [ "$MAJOR" -eq 21 ] && [ "$MINOR" -eq 1 ] && [ "$PATCH" -eq 0 ]; then
  VULNERABLE=true
  FIXED_HF="Hotfix-BIGIP-21.1.0.2.0.30.22-ENG"
fi

# 17.5.0 - 17.5.1
if [ "$MAJOR" -eq 17 ] && [ "$MINOR" -eq 5 ] && [ "$PATCH" -le 1 ]; then
  VULNERABLE=true
  FIXED_HF="Hotfix-BIGIP-17.5.1.9.0.160.12-ENG"
fi

# 17.1.0 - 17.1.3
if [ "$MAJOR" -eq 17 ] && [ "$MINOR" -eq 1 ] && [ "$PATCH" -le 3 ]; then
  VULNERABLE=true
  FIXED_HF="Hotfix-BIGIP-17.1.3.5.0.41.14-ENG"
fi

if [ "$VULNERABLE" = false ]; then
  echo "PATCHED — BIG-IP version $VERSION is not in the affected range."
  exit 0
fi

# --- 5. Check if hotfix is applied ---
HF_INSTALLED=$(tmsh show sys version | grep -i 'Hotfix' || true)
if echo "$HF_INSTALLED" | grep -qiE '(21\.1\.0\.2\.0\.30\.22|17\.5\.1\.9\.0\.160\.12|17\.1\.3\.5\.0\.41\.14)'; then
  echo "PATCHED — Hotfix for CVE-2026-94127 is installed."
  exit 0
fi

# --- 6. Check if iRule mitigation is in place ---
IRULE_MIT=$(tmsh list ltm virtual 2>/dev/null | grep -ci 'cve.2026.94127\|oauth_mitigation' || true)
if [ "$IRULE_MIT" -gt 0 ]; then
  echo "VULNERABLE (mitigated) — Version $VERSION with OAuth AS profile is affected, but iRule mitigation appears applied. Install hotfix: $FIXED_HF"
  exit 1
fi

echo "VULNERABLE — BIG-IP $VERSION with $OAUTH_PROFILES OAuth AS profile(s) is affected by CVE-2026-94127."
echo "Apply iRule mitigation immediately and install hotfix: $FIXED_HF"
exit 1

1. F5 Advisory K000162605
2. BleepingComputer — F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks
3. CISA KEV Alert — September 22, 2026
4. SecurityWeek — Critical F5 BIG-IP Vulnerability Exploited as Zero-Day
5. runZero — F5 BIG-IP RCE exploit: Find impacted systems
6. Field Effect — F5 Fixes Actively Exploited BIG-IP APM Vulnerability
7. Cybersecurity News — F5 BIG-IP OAuth Server 0-day Flaw
8. Rapid7 — CVE-2026-94127 Vulnerability Database