Critical F5 BIG-IP 0-Day Exploited for Remote Code Execution
Hackers are actively exploiting a critical zero-day vulnerability (CVE-2026-94127) in F5 BIG-IP APM OAuth servers, allowing unauthenticated remote code execution.
F5 has issued a stern warning that threat actors are actively exploiting a critical zero-day vulnerability within its BIG-IP Access Policy Manager (APM) deployments. The flaw, tracked as CVE-2026-94127, enables unauthenticated remote code execution and specifically targets virtual servers configured with both an APM access policy and an OAuth profile where APM functions as an OAuth Authorization Server.
F5 disclosed advisory K000162605 on September 22, 2026, acknowledging that the vulnerability had already been weaponized in the wild. The vulnerability is a heap-based buffer overflow (CWE-122), internally designated as ID 2524777. Attackers can leverage specially crafted network traffic to corrupt memory, leading to arbitrary code execution on the affected BIG-IP system. The flaw carries a severe CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3, indicating low attack complexity, network accessibility, and no requirement for privileges or user interaction, with potentially devastating impacts on confidentiality, integrity, and availability.
It is crucial to note that exploitation is contingent on specific configurations rather than the mere presence of APM. Deployments utilizing APM solely as an OAuth Client or Resource Server, without OAuth authorization-server profiles, are not vulnerable. However, appliance-mode systems remain susceptible. F5 clarified that the vulnerability resides within the data plane, which handles application traffic, and does not expose the control plane. Consequently, merely restricting access to the management interface will not prevent exploitation attempts targeting an affected virtual server.
Several BIG-IP versions are known to be vulnerable, including BIG-IP APM 21.1.0, versions 17.5.0 through 17.5.1, and versions 17.1.0 through 17.1.3. F5 has stated that releases beyond their End of Technical Support lifecycle have not been evaluated, and their absence from the affected list should not be interpreted as a sign of safety. Other F5 products, such as BIG-IQ, BIG-IP Next, F5 Distributed Cloud services, NGINX products, F5OS variants, and F5 AI Gateway, have been assessed as unaffected.
F5 has released engineering hotfixes for the affected branches: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso, and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG.iso. Organizations are urged to immediately inventory their BIG-IP APM virtual servers, identify those with the vulnerable access-policy and OAuth-profile combination, and apply the relevant hotfix. For environments where immediate patching is not feasible, F5 Support can provide an iRule to temporarily mitigate attacks against the affected virtual server.
Security teams are advised to hunt for indicators of compromise, including a pattern of repeated OAuth authentication failures occurring closely with suspicious command executions and subsequent Traffic Management Microkernel (TMM) SIGABRT events. F5 suggests investigating logs for ten or more invalid-token messages originating from a single IP address, correlating these with TMM core files. While neither an authentication failure nor a core file alone confirms a breach, their frequency and temporal relationship are significant indicators.
CISA has officially added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the urgency for remediation due to confirmed in-the-wild exploitation. While F5 discovered the vulnerability internally, details regarding the specific threat actors, the scale of exploitation, or post-compromise objectives remain undisclosed. This uncertainty emphasizes the importance of proactive threat hunting and log preservation alongside immediate patching efforts.