F5 Fixes Actively Exploited BIG-IP APM OAuth Flaw

F5 has released engineering hotfixes for a critical vulnerability in BIG-IP Access Policy Manager (APM) that attackers are already exploiting to run code on affected systems without first logging in. The company disclosed the flaw, tracked as CVE-2026-94127, in a September 22 advisory. F5 rates the heap-based buffer overflow, a memory error, at 9.8 out of 10 on CVSS version 3.1 and 9.3 on CVSS version 4.0, and it affects only deployments in which APM acts as an OAuth authorization server, the component that issues access tokens to applications.

APM is the BIG-IP module that controls how users reach an organization's applications and networks. The vulnerable setup requires an APM access policy and an OAuth authorization server profile on the same virtual server, the address that receives OAuth traffic. When specific malicious traffic is sent to that virtual server, it can trigger remote code execution, which means an attacker can run commands on the device. Because the attack traffic targets the virtual server itself, restricting access to the BIG-IP management interface offers no protection, and systems in Appliance mode are also at risk.

Affected versions and their corresponding engineering hotfixes are: branch 21.1 version 21.1.0 before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG; branch 17.5 versions 17.5.0 to 17.5.1 before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG; and branch 17.1 versions 17.1.0 to 17.1.3 before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. Systems that use APM only as an OAuth client or resource server, without OAuth authorization server profiles, are not affected. F5 updated its CVE record at 00:45 UTC on September 23 to clarify that the flaw is present only in the authorization server role. Earlier publications from CISA and CERT-EU described the condition more broadly as an access policy and an OAuth profile on a virtual server. According to F5's configuration guide, the authorization server's OAuth profile is created under Access > Federation > OAuth Authorization Server > OAuth Profile and then selected in an access profile attached to the virtual server; a virtual server set up this way matches the vulnerable condition. F5 did not evaluate versions that have reached End of Technical Support, meaning they no longer receive standard fixes, so their status is unknown rather than safe.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog on September 22 and gave federal civilian agencies until September 25 to apply F5's mitigations under a directive issued in June. CERT-EU, the cybersecurity service for EU institutions, published its own advisory. Neither F5's CVE record nor the CISA and CERT-EU advisories state how many systems were attacked, who the attackers are, or which organizations were targeted. F5 also notes that another APM flaw, CVE-2025-53521, was added to CISA's KEV catalog in March; its fixes for the 17.1 and 17.5 branches, 17.1.3 and 17.5.1.3, fall inside the affected ranges above, so a system updated to either build still needs the new hotfix if APM acts as an OAuth authorization server on it.

F5's primary fix is the engineering hotfix listed for each branch. When the hotfix cannot be installed immediately, F5 offers an iRule mitigation for the affected virtual server; customers obtain it by opening a ticket with F5 support. CERT-EU advises preserving forensic evidence first, applying the hotfix, checking for signs of compromise, and starting incident response if any are found. CISA told agencies to apply the iRule first 'to allow for proactive forensic triage,' and then to 'install the final vendor patch as soon as possible.'

To check for compromise, F5 lists several signs in CERT-EU's advisory. The combination that should trigger a human review is repeated OAuth authentication failures, followed by suspicious commands, followed by a TMM SIGABRT shortly after. In APM logs, look for repeated failed UserInfo requests in /var/log/apm with the error description 'The access token is invalid,' especially 10 or more requests from a single IP address within a short time. An unexplained rise in total_failed when running tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed can also indicate trouble. Audit logs may show suspicious commands in /var/log/audit around the same times. TMM core files are not a sign on their own, but F5 has seen TMM enter a loop, causing the SOD daemon to send a SIGABRT. The CVE record and the CISA and CERT-EU advisories do not say whether installing the hotfix removes access that an attacker already has.

For organizations that operate public-facing network access appliances like BIG-IP, keeping a close watch on vendor advisories and applying engineering hotfixes quickly is essential. Teams that need help staying current with patches and incident response can turn to a security-first IT and infrastructure partner such as AEU-I, which offers security-first IT, infrastructure and consulting services.