F5 Warns of Exploited Critical BIG-IP APM OAuth RCE Vulnerability

F5 has disclosed a critical vulnerability in BIG-IP Access Policy Manager (APM) that can allow an unauthenticated attacker to execute code remotely on affected systems.

Tracked as CVE-2026-94127, the vulnerability affects specific BIG-IP APM deployments where an access policy and an OAuth profile are configured on a virtual server, with BIG-IP APM operating as an OAuth Authorization Server.

F5 states that the vulnerability has been exploited.

The issue is classified as a CWE-122 heap-based buffer overflow and carries a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3, both rated Critical.

What is affected?

The vulnerability is tied specifically to the OAuth functionality of BIG-IP APM.

According to F5, deployments using APM strictly as an OAuth Client or Resource Server, without OAuth Authorization Server profiles configured, are not affected.

F5 also states that BIG-IP systems operating in Appliance mode are vulnerable.

The issue affects the data plane, while F5 says there is no control plane exposure.

The affected versions identified by F5 are:

F5 notes that its evaluation covers software versions that have not reached the End of Technical Support phase.

Other BIG-IP modules, BIG-IQ Centralized Management, BIG-IP Next CNF, BIG-IP Next for Kubernetes, F5 Distributed Cloud services, F5OS, NGINX products and F5 AI Gateway are listed by F5 as not vulnerable to this issue.

The vulnerability is already being exploited

One of the most significant details in F5's advisory is that the company has confirmed exploitation.

F5 describes the vulnerability as capable of enabling unauthenticated remote code execution. This means the advisory does not describe the issue as requiring an authenticated user before exploitation.

The company does not disclose detailed exploit instructions in the advisory.

Additional details were not disclosed in the announcement.

How the vulnerability relates to OAuth

The affected component is the APM OAuth functionality.

In the affected configuration, BIG-IP APM acts as an OAuth Authorization Server. F5 specifically distinguishes this configuration from deployments where APM is used only as an OAuth Client or Resource Server.

This distinction is important for organisations assessing exposure. Simply running BIG-IP APM does not, according to F5, mean that every deployment is affected. Administrators need to determine whether the vulnerable OAuth Authorization Server functionality is configured.

F5 recommends installing the available fixes

F5 recommends that organisations running a version listed as vulnerable install the corresponding fixed version or hotfix.

The fixes are currently provided as engineering hotfixes through F5 Downloads. F5 also notes that the engineering hotfixes contain fixes included in BIG-IP Hardened Releases 2 and references its documentation for engineering hotfix releases on BIG-IP 17.5.1.9 and 17.1.3.5.

For branches where a direct fix is not listed, F5 recommends upgrading to a version containing the fix.

Administrators should consult F5's current advisory and product documentation before applying changes to production systems.

Mitigation is available

F5 also provides a mitigation option for organisations that cannot immediately deploy the applicable fix.

The company recommends applying an iRule to the affected BIG-IP APM virtual server. F5 states that organisations should contact F5 Support to obtain the required iRule.

The advisory does not provide the iRule itself.

The company did not provide specific information about alternative mitigation mechanisms beyond the iRule described in the advisory.

F5 provides indicators for investigation

Because F5 has observed exploitation, the advisory also includes indicators of compromise for security teams investigating potentially affected systems.

F5 cautions that individual indicators do not necessarily confirm compromise. Instead, the company highlights the significance of multiple signals appearing close together.

The high-level pattern described by F5 is:

Repeated OAuth authentication failures → suspicious commands → TMM SIGABRT → investigation

OAuth authentication failures

F5 identifies repeated OAuth authentication failures as a medium-confidence indicator.

The relevant message appears in:

/var/log/apm

The advisory says that the presence of this message by itself is not confirmation of an attack because the message can occur during normal activity.

F5 identifies sustained repetition of at least 10 occurrences in one log as an anomaly that should receive human review, particularly when the activity originates from a single IP address.

Security teams should therefore focus on repetition, timing and correlation rather than treating a single failed OAuth request as evidence of compromise.

BIG-IP OAuth statistics

F5 also provides a command for reviewing BIG-IP APM OAuth failure statistics:

tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed

According to the advisory, an unexplained increase in the total_failed value should be investigated.

Audit logs

If repeated OAuth failures are identified, F5 recommends examining audit logs around the relevant timestamps.

The advisory points administrators to:

/var/log/audit

This can help security teams correlate authentication activity with other events occurring on the BIG-IP system.

TMM core files

F5 also describes the presence of TMM core files as an investigation signal.

The company observed TMM entering a loop that causes the SOD daemon to send a SIGABRT.

However, F5 explicitly states that the presence of a TMM core file alone is not an indicator of compromise and should be investigated in combination with other signals.

What security teams should check

Organisations using BIG-IP APM can use the advisory to structure an immediate exposure review.

1. Identify affected versions

Determine whether BIG-IP APM is running one of the versions listed as vulnerable by F5.

2. Check the OAuth configuration

Confirm whether BIG-IP APM is configured as an OAuth Authorization Server and whether the relevant OAuth profile is attached to a virtual server.

3. Review authentication logs

Look for repeated OAuth authentication failures, paying particular attention to sustained repetition and activity associated with individual source IP addresses.

4. Review OAuth statistics

Investigate unexplained increases in the total_failed OAuth statistic.

5. Correlate audit activity

Review audit logs around timestamps associated with suspicious OAuth activity.

6. Investigate TMM core files

Check for relevant TMM core files and correlate them with other indicators rather than treating their presence alone as proof of compromise.

7. Apply the F5 fix or mitigation

Where an affected version is identified, deploy the applicable F5 engineering hotfix or move to a release containing the fix. If immediate remediation is not possible, consult F5 Support regarding the available iRule mitigation.

Broader security context

The disclosure highlights an important operational challenge for security teams managing infrastructure appliances: exposure depends not only on the product version but also on how specific functionality is configured.

In this case, F5 identifies a particular OAuth Authorization Server configuration as the condition associated with the vulnerability. That makes configuration assessment an important part of vulnerability management alongside conventional version scanning.

The exploitation disclosure also means that organisations should consider vulnerability remediation and incident investigation together when evaluating affected deployments.

This does not mean that every vulnerable installation has been compromised. F5's own guidance distinguishes individual indicators from combinations of signals that warrant deeper investigation.

For enterprises, the development reinforces the value of maintaining accurate configuration inventories, monitoring authentication anomalies and having a defined process for responding to critical vulnerabilities in internet-facing infrastructure.

Key takeaways

• CVE: CVE-2026-94127

• Product: BIG-IP APM

• Component: APM OAuth

• Issue: Heap-based buffer overflow

• Severity: Critical

• CVSS v3.1: 9.8

• CVSS v4.0: 9.3

• Attack condition: Specific BIG-IP APM OAuth Authorization Server configuration

• Authentication required: F5 describes the RCE as unauthenticated

• Exploitation: F5 states that exploitation has been observed

• Affected branches: BIG-IP APM 21.x and selected 17.x versions

• Mitigation: iRule available through F5 Support

• Recommended response: Apply the applicable F5 fix and investigate relevant indicators