2026-013: Critical Vulnerability in F5 BIG-IP APM
CERT-EU says exploited F5 BIG-IP APM flaw CVE-2026-94127 allows unauthenticated remote code execution.
On 22 September 2026, CERT-EU warned that F5 BIG-IP APM vulnerability CVE-2026-94127, a CVSS 9.8 heap-based buffer overflow, allows unauthenticated remote code execution when an access policy and OAuth profile are configured on a virtual server. F5 confirmed active exploitation. Affected versions include 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0. CERT-EU urges immediate hotfixes, evidence preservation, and checks for OAuth failures followed by suspicious commands and TMM crashes.
- CVE-2026-94127 is a CVSS 9.8 heap overflow enabling unauthenticated RCE.
- It applies when an access policy and OAuth profile are configured.
- F5 confirmed active exploitation in the wild.
- Affected branches include 17.1, 17.5, and 21.1.
- CERT-EU urges hotfixes, forensics, and compromise checks.
Vulnerabilities mentionedAll →
- CVE-2026-941279.32%Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profilepublished · F5 BIG-IP (Access Policy Manager) KEV PoC ×2
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Full article362 words · extracted from cert.europa.eu · click to collapse
Release Date: 22-09-2026 16:52:36
History:
- 22/09/2026 --- v1.0 -- Initial publication
Summary
On 22 September 2026, F5 published an advisory addressing a critical vulnerability affecting its BIG-IP APM product. The vendor confirmed active exploitation in the wild [1].
CERT-EU recommends taking appropriate actions as soon as possible.
Technical Details
The vulnerability CVE-2026-94127, with a CVSS score of 9.8, is a heap-based buffer overflow vulnerability and allow unauthenticated attacker to achieve remote code execution (RCE) on the affected device [1].
Affected Products
The vulnerability affects the following versions of BIG-IP APM if configured with an access policy and an OAuth profile on a virtual server [1]:
- 17.1.0 - 17.1.3
- 17.5.0 - 17.5.1
- 21.1.0
Recommendations
CERT-EU recommends taking the following actions as soon as possible:
- Preserve forensic evidence.
- Apply the relevant hotfix.
- Check for signs of compromise (see the compromise assessment section). If any sign of compromise is detected, start the incident response process.
Mitigation
If patching cannot be applied immediately, F5 provides an iRule-based mitigation for the affected virtual server. To obtain it, F5 BIG-IP clients should contact the F5 support [1].
Compromise Assessment
CERT-EU strongly advises to look for the following indicators of compromise provided by the vendor in its advisory [1]:
At a high level, multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT is the combination that should lead to human review of the system.
- OAuth authentication failures: check
/var/log/apmfor repeated occurrences of the following, especially 10 or more from a single IP in a short window.
<DATE> <HOST> err tmm1\[30975\]: 01990004:3: <PROFILE\_NAME>: Request UserInfo from Source ID (null) IP <IP> failed. Error Code (invalid\_token) Error Description (The access token is invalid.) - Increase of OAuth failure statistics. Run the following and look for an unexplained increase in
total_failed:
$ tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed Audit log anomalies: if OAuth failures are observed, review
/var/log/auditaround those timestamps for suspicious commands.TMM core files: Presence of a TMM core file alone is not an indicator, but core files should be investigated. The vendor indicates that they have observed TMM entering a loop, which causes the SOD daemon to send a SIGABRT.