F5 BIG-IP APM CVE-2026-94127: Unauthenticated RCE Exploited in the Wild

The device most enterprises put in front of their applications to do authentication just became the way to skip it. On 22 September 2026, F5 published advisory K000162605 for CVE-2026-94127, a CVSS 9.8 unauthenticated remote code execution flaw in BIG-IP Access Policy Manager (APM). CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal remediation deadline of 25 September — the short-fuse timeline CISA reserves for bugs already being used against real targets. There was no public proof-of-concept when the advisory dropped. There didn't need to be one: someone already had a working exploit.

What CVE-2026-94127 actually is

APM is F5's identity gateway — the module that fronts VPN portals, application access, and single sign-on. In many deployments it also acts as an OAuth authorization server, minting and validating tokens for the applications behind it. CVE-2026-94127 lives in exactly that code path.

The bug is a heap-based buffer overflow in the traffic-management microkernel (TMM), the data-plane process that handles every packet the appliance forwards. According to F5 and the Rapid7 analysis, an unauthenticated attacker with network reach to an affected virtual server can trigger the overflow by sending specially crafted traffic to the OAuth authorization endpoint. No credentials, no prior foothold, no user interaction. A memory-corruption primitive in a network-facing daemon that runs as root is about the worst place a bug can be, and the reachable attack surface is a login server that, by design, accepts requests from anyone.

The condition that makes a device vulnerable is specific: a virtual server configured with both an APM access policy and an OAuth authorization server profile. That precision is the only good news in the advisory, and — as the next section argues — it is thinner comfort than it reads.

"Not the default configuration" is cold comfort

F5 is careful to note that CVE-2026-94127 is not exposed in a default install. Deployments that use APM purely as an OAuth client or resource server — consuming tokens rather than issuing them — are not affected. That framing invites a dangerous shrug: we're probably fine.

The problem is that the vulnerable configuration is not exotic. Standing up BIG-IP APM as an OAuth authorization server is a mainstream pattern for organisations that centralise SSO on their F5 estate — it is one of the reasons enterprises buy APM in the first place. And the population that gets this wrong is not small. The Shadowserver Foundation reported roughly 15,000 internet-exposed BIG-IP APM instances at the time of disclosure, split almost evenly between North America and Europe. Not all of those run the vulnerable profile — but "not all" is not a number anyone reading this can substitute for their own configuration audit.

The honest posture is the inverse of the shrug: assume you need to prove you are not running the trigger condition, rather than assume you are not. On an appliance that has been in the estate for years, accreting virtual servers and profiles across team handovers, "we don't think we have that configured" is a hypothesis, not a control.

A memory-safety fault F5 has already seen on this exact surface

Here is the detail that should change how you read this CVE: the OAuth-in-APM parsing path has thrown a memory-safety fault before, and recently.

In October 2025, F5 patched CVE-2025-54854, an out-of-bounds read (CWE-125) in BIG-IP APM's OAuth access-profile handling. Undisclosed traffic could make the apmd process read past a buffer and terminate — a denial of service, one severity tier below what we have now. Same subsystem, same "crafted OAuth traffic reaches a parser that mishandles memory" shape. Eleven months later the same surface yields a heap write that reaches code execution instead of a read that reaches a crash. This is not a coincidence of two unrelated bugs; it is a class of defect in one component being worked, instance by instance.

Attackers had a head start on that class. In October 2025, F5 disclosed that a nation-state actor — later tracked as the China-nexus cluster UNC5221 — had spent roughly a year inside its product-development environment and exfiltrated BIG-IP source code along with information about undisclosed vulnerabilities. A memory-corruption RCE surfacing in a niche APM code path, weaponised before a public PoC exists, is precisely the shape of risk that theft created. Whether or not CVE-2026-94127 traces directly to that stolen material, the disclosure told every BIG-IP operator something durable: the people best positioned to find the next bug in this platform are not necessarily the ones filing CVEs.

The reachability question CVSS 9.8 doesn't answer

A 9.8 tells you the bug is catastrophic if reached. It says nothing about whether, on your network, an unauthenticated attacker can actually put crafted bytes in front of that OAuth authorization endpoint — or which of your dozens of virtual servers carries the fatal profile combination. Those are the questions that decide whether you were breached this week or merely eligible to be.

"We ran the scanner. It flagged the BIG-IP as 'APM present, version in range.' It did not tell us that only two of our fourteen virtual servers had an OAuth authorization profile bound, that one of them was reachable from the guest VLAN through a forgotten route, and that the other sat behind a WAF policy that happened to drop the trigger. One of those facts got someone paged at 2 a.m. The scan couldn't rank them."

Version-in-range is a filing status. Reachability is the finding. Closing that gap means starting from a realistic foothold and asking whether the crafted request actually lands on your build and your topology — the difference between a line item deferred to next quarter and a proven path to root on the box that authenticates your applications.

Remediation

Treat any potentially-exposed BIG-IP APM as an incident-response subject, not just a patch target — the bug was exploited before the fix shipped, so "we patched" and "we were never hit" are separate claims.

1. Am I affected?

Check whether any virtual server binds both an APM access policy and an OAuth authorization server profile. From the CLI:

tmsh list ltm virtual all-properties | grep -iE 'profiles|policies'
tmsh list apm profile access
tmsh list apm oauth server

Then confirm your running software falls in the affected ranges:

Branch	Affected	Fixed (engineering hotfix)
21.1	21.1.0	Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
17.5	17.5.0 – 17.5.1	Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
17.1	17.1.0 – 17.1.3	Hotfix-BIGIP-17.1.3.5.0.41.14-ENG

APM used only as an OAuth client or resource server is not affected — but verify that, don't assume it.

2. Patch — exact fixed versions

Apply the engineering hotfix for your branch, verbatim from F5 K000162605: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG (or later). These are engineering hotfixes distributed through F5 Support, not point releases — plan the maintenance window accordingly.

3. Can't patch now? — compensating controls

• Apply F5's official iRule mitigation, obtained by opening an F5 Support case. It reduces exposure on the vulnerable virtual server while you stage the hotfix.
• Restrict network reach to the OAuth authorization endpoint. If the authz server only needs to serve a known set of applications and identity flows, it should not be answering the whole internet — tighten the virtual server's source scoping and upstream ACLs.
• Front the endpoint with a WAF/L7 policy that rejects malformed OAuth requests. This is a stopgap against opportunistic traffic, not a fix — a targeted attacker who knows the exact trigger can often shape a request that passes.

4. Hunt for compromise

F5's own guidance names the sequence to look for: multiple OAuth authentication failures, followed by suspicious administrative commands, shortly followed by a TMM SIGABRT — that combination should trigger human review. Concretely:

• Repeated failed OAuth UserInfo requests logging "The access token is invalid," and unexplained spikes in failed-OAuth counters (F5 suggests 10+ failures from a single source IP as a review threshold) — maps to MITRE ATT&CK T1190 Exploit Public-Facing Application.
• TMM core files / SIGABRT crashes on the APM data plane — the memory-corruption footprint.
• New or unexpected processes, shells, or outbound connections from the BIG-IP to never-seen destinations (T1059 execution, T1071 C2). A rooted appliance beaconing outbound is not normal BIG-IP behaviour.
• Unexpected changes to configuration, iRules, or credentials on the box (T1505 server component / persistence).

5. Eradicate + verify

An unauthenticated RCE that lands as root on the data plane means the appliance's own logs are attacker-writable — a compromised BIG-IP can rewrite the very apmd/TMM records you are hunting through. So:

• Patch first, then treat every secret the device held as exposed: rotate admin credentials, API tokens, TLS/SSL keys and certificates, OAuth signing keys and client secrets, and any credentials the box used to reach back-end systems.
• Rebuild rather than clean if you find evidence of code execution — root on the data plane forecloses trusting the on-box state.
• Confirm clean after patching, and corroborate on-box findings against off-box evidence: netflow, upstream firewall logs, and DNS. A device that can edit its own audit trail cannot be its own alibi.

Where Zero Hunt fits

The article opened on a question a severity score cannot answer: not how bad is CVE-2026-94127, but can it be reached on your BIG-IP, on your topology, right now — and which of your virtual servers carries the fatal profile combination.

That is a validation problem, and it is what Zero Hunt's 10-agent generative swarm is built to answer. On a change-triggered campaign — a newly exposed management interface, a freshly published CVE — the Recon, Exploit and Pivot agents take a realistic foothold and test whether the crafted request actually lands on your build and your segmentation, not the network diagram's. The exploit is written per target by a local LLM on the appliance, not pulled from a public PoC — which matters precisely in a zero-day window where no public PoC yet exists, the window UNC5221 has repeatedly operated inside. Every new offensive skill is backtested in the AI Gym against a CVE-based black-box corpus before it touches production, and every finding is ECDSA-signed at write time, so the output is "this OAuth authorization VIP was reachable from the guest VLAN and the overflow landed — here is the proof," not a 9.8 deferred to next quarter.

The follow-through belongs to the wire. Once an attacker holds root on the TMM data plane, the appliance's own telemetry becomes their statement, not your evidence — which is exactly why F5's detection guidance leans on cross-referencing off-box signals. Zero Hunt's AI Traffic Analysis reads that traffic behaviourally: a deep-learning model with four inference heads, running on the appliance GPU at 2.7+ Gbit/s, whose application-fingerprinting head knows what normal APM and OAuth traffic looks like — so the anomalous authorization payload, the post-exploitation shell, and a beacon to a never-seen ASN surface while they happen, on a box that can already rewrite its own logs. And because APM guards access to regulated applications, the same finding maps across NIS2, DORA and ISO 27001 in Zero Hunt's compliance layer — one exposure, evidenced once, signed once.