RCE Vulnerability in F5 BIG-IP APM (CVE-2026-94127)

Source context: this article examines information published by the source on September 22, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.

What the vulnerability is

CVE-2026-94127 is a heap-based buffer overflow vulnerability in F5 BIG-IP APM. If exploited, this flaw allows an unauthenticated attacker to achieve remote code execution (RCE) on the affected device.

Exposure and applicability

This vulnerability does not affect all BIG-IP APM installations. It specifically applies to devices running the following versions that are configured with both an access policy and an OAuth profile on a virtual server:
* 17.1.0 – 17.1.3
* 17.5.0 – 17.5.1
* 21.1.0

Potential breach-prevention strategy

The vendor has confirmed active exploitation of this vulnerability in the wild. The reported entry path is via unauthenticated requests to virtual servers utilizing OAuth profiles, though the specific payload used to trigger the buffer overflow remains undisclosed.

Our analysis suggests a similar breach could have been mitigated through the following prioritized actions:

1. Configuration Audit (Preventative): Identify all virtual servers using OAuth profiles and access policies. This reduces the attack surface by ensuring only necessary services are exposed. Responsible Role: Infrastructure Owner/Network Security Engineer. Verification involves reviewing current BIG-IP configuration files for active OAuth profiles.
2. Implementation of Temporary Mitigations (Preventative): In scenarios where immediate patching is not feasible, applying the vendor-provided iRule mitigation could have reduced the likelihood of initial compromise. Responsible Role: Vulnerability Management Team. Effectiveness can be verified by confirming the iRule is active on all affected virtual servers.
3. Forensic Log Aggregation (Detection/Recovery): Centralizing /var/log/apm and /var/log/audit logs to a SIEM could have improved detection speed. Responsible Role: Security Operations Center (SOC). Verification involves confirming that ‘invalid_token’ error patterns are triggering alerts.
4. Memory Integrity Monitoring (Detection): Establishing a baseline for TMM core file generation would allow defenders to identify the SIGABRT events associated with this exploit more rapidly. Responsible Role: System Administrator. Verification involves auditing existing core dump directories for unexplained files.

Remediation priorities

Defenders should prioritize actions in the following order:
1. Forensic Preservation: Before applying updates, preserve current logs and system state to allow for a compromise assessment.
2. Patching: Apply the relevant hotfix provided by F5 to resolve the underlying buffer overflow.
3. Temporary Mitigation: If patching is delayed, contact F5 support to obtain and deploy the iRule-based mitigation for affected virtual servers.

How to validate remediation

Verification must go beyond a version check, as the vulnerability depends on specific configurations. To verify that exposure has been reduced:
* Configuration Check: Confirm if an access policy and OAuth profile are still required; if they can be removed, the attack vector is eliminated.
* Patch Verification: Confirm the hotfix installation via the system’s package manager or version string.
* Mitigation Validation: If using the iRule, verify its application to every virtual server identified during the audit phase.
* Compromise Assessment: Review /var/log/apm for 10 or more invalid_token errors from a single IP and check tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed for unexplained increases in total_failed. Additionally, inspect /var/log/audit for suspicious commands coinciding with these failures.

Limits and open questions

The iRule is a mitigation and not a permanent replacement for the hotfix. Furthermore, while TMM core files resulting from SIGABRT are an indicator of potential exploitation, the presence of a core file alone does not prove a successful compromise. Residual risk remains if forensic audits are not performed prior to patching, as existing persistence may survive the update.

Source and editorial note

Security Advisory 2026-013 · Source date: September 22, 2026 · Retrieved September 22, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment