Critical F5 BIG-IP 0-Day Exploited for Remote Code Execution
Hackers are actively exploiting a critical zero-day vulnerability (CVE-2026-94127) in F5 BIG-IP APM OAuth servers, allowing unauthenticated remote code execution.
F5 has issued a stern warning that threat actors are actively exploiting a critical zero-day vulnerability within its BIG-IP Access Policy Manager (APM) deployments. The flaw, tracked as CVE-2026-94127, enables unauthenticated remote code execution and specifically targets virtual servers configured with both an APM access policy and an OAuth profile where APM functions as an OAuth Authorization Server.
F5 disclosed advisory K000162605 on September 22, 2026, acknowledging that the vulnerability had already been weaponized in the wild. The vulnerability is a heap-based buffer overflow (CWE-122), internally designated as ID 2524777. Attackers can leverage specially crafted network traffic to corrupt memory, leading to arbitrary code execution on the affected BIG-IP system. The flaw carries a severe CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3, indicating low attack complexity, network accessibility, and no requirement for privileges or user interaction, with potentially devastating impacts on confidentiality, integrity, and availability.
It is crucial to note that exploitation is contingent on specific configurations rather than the mere presence of APM. Deployments utilizing APM solely as an OAuth Client or Resource Server, without OAuth authorization-server profiles, are not vulnerable. However, appliance-mode systems remain susceptible. F5 clarified that the vulnerability resides within the data plane, which handles application traffic, and does not expose the control plane. Consequently, merely restricting access to the management interface will not prevent exploitation attempts targeting an affected virtual server.
Several BIG-IP versions are known to be vulnerable, including BIG-IP APM 21.1.0, versions 17.5.0 through 17.5.1, and versions 17.1.0 through 17.1.3. F5 has stated that releases beyond their End of Technical Support lifecycle have not been evaluated, and their absence from the affected list should not be interpreted as a sign of safety. Other F5 products, such as BIG-IQ, BIG-IP Next, F5 Distributed Cloud services, NGINX products, F5OS variants, and F5 AI Gateway, have been assessed as unaffected.
F5 has released engineering hotfixes for the affected branches: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso, and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG.iso. Organizations are urged to immediately inventory their BIG-IP APM virtual servers, identify those with the vulnerable access-policy and OAuth-profile combination, and apply the relevant hotfix. For environments where immediate patching is not feasible, F5 Support can provide an iRule to temporarily mitigate attacks against the affected virtual server.
Security teams are advised to hunt for indicators of compromise, including a pattern of repeated OAuth authentication failures occurring closely with suspicious command executions and subsequent Traffic Management Microkernel (TMM) SIGABRT events. F5 suggests investigating logs for ten or more invalid-token messages originating from a single IP address, correlating these with TMM core files. While neither an authentication failure nor a core file alone confirms a breach, their frequency and temporal relationship are significant indicators.
CISA has officially added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the urgency for remediation due to confirmed in-the-wild exploitation. While F5 discovered the vulnerability internally, details regarding the specific threat actors, the scale of exploitation, or post-compromise objectives remain undisclosed. This uncertainty emphasizes the importance of proactive threat hunting and log preservation alongside immediate patching efforts.
This new report specifies that the vulnerability, tracked as CVE-2023-46747, affects F5 BIG-IP application delivery controllers. It allows unauthenticated attackers to execute arbitrary code remotely by sending specially crafted traffic to vulnerable instances, and is being actively exploited in the wild as a zero-day.
The vulnerability, now tracked as CVE-2026-94127, has been officially added to the CISA Known Exploited Vulnerabilities (KEV) catalog, mandating prioritized patching for federal agencies. While a public proof-of-concept was not immediately available, F5 has released specific hotfixes for affected BIG-IP versions and provided an iRule workaround for organizations unable to patch immediately.
The vulnerability, CVE-2026-94127, specifically affects F5 BIG-IP systems configured as OAuth authorization servers, a detail not explicitly mentioned in the initial report. While the original article noted the critical nature and potential for unauthenticated RCE, this update clarifies that the flaw is a heap-based buffer overflow and rates it 9.8/10 on CVSS v3.1 and 9.3/10 on CVSS v4.0. Furthermore, F5 has released engineering hotfixes for specific versions (21.1, 17.5, and 17.1) and provided an iRule mitigation for immediate deployment while patches are applied.
The Register article provides further context on the exploitation of CVE-2026-94127, noting that F5 has not yet disclosed the number of compromised systems or whether ransomware has been deployed. It also draws a parallel to a sophisticated nation-state attack from a year prior where F5's network was breached, leading to the theft of BIG-IP source code and customer data.
This new analysis from watchTowr Labs provides a deeper technical dive into CVE-2026-94127, detailing how the vulnerability arises from an oversized 'Authorization' header that triggers a heap overflow. The researchers highlight the specific code changes in the patched version, illustrating the allocation of a 0x4100-byte buffer and the extraction of the header size as key points in the exploitation chain.