F5 BIG-IP APM Zero-Day: Critical RCE vulnerability exploited

A critical zero-day vulnerability in F5 BIG-IP Access Policy Manager (APM) is being actively exploited by malicious actors, allowing remote code execution without any authentication. The vulnerability, identified as CVE-2026-94127 , affects systems where BIG-IP APM acts as an OAuth authorization server and has already been added to the CISA list of known exploitable vulnerabilities . F5 released engineering hotfixes on September 22, 2026 , and U.S. federal agencies were ordered to implement the fixes within three days.

BIG -IP APM is F5's module that controls how users access an organization's applications and networks. The vulnerable configuration includes an APM access policy and an OAuth authorization server profile on the same virtual serverthat hosts the BIG-IP address that accepts OAuth traffic. Specific malicious traffic sent to this virtual server could lead to remote code execution (RCE), i.e., full execution of commands by the attacker without having to log in to the system.

The vulnerability is classified as a heap-based buffer overflow and has received a score of 9.8 out of 10 on CVSS v3.1 and 9.3 on CVSS v4.0, making it one of the most serious vulnerabilities disclosed this year.

See also: Meshtastic: Critical GitHub Actions flaw with pull_request_target allows supply chain compromise (CVE-2026-44359)

BIG-IP APM Zero-Day: Technical Details and Affected Versions

According to the F5 configuration guide for APM versions 17.1, 17.5, and 21.0 , the authorization server OAuth profile is created via the path Access > Federation > OAuth Authorization Server > OAuth Profile and is selected in an access profile associated with the virtual server. A virtual server configured in this way meets the condition described by F5 to be vulnerable. Importantly, systems that use APM only as an OAuth client or resource server , without OAuth authorization server profiles , are not affected .

Additionally, because the malicious traffic targets the virtual server itself, restricting access to the BIG-IP management interface is not an effective mitigation measure. BIG-IP systems in Appliance mode are also vulnerable.

F5 updated the CVE on September 23, 2026 to clarify that the vulnerability only exists in the authorization server role. F5 did not evaluate versions that have reached End of Technical Support, so their status remains unknown.

BIG-IP APM Zero-Day: Breach Detection and Response Guidelines

CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) list on September 22, 2026 , giving U.S. federal agencies until September 25 to implement F5’s mitigations. When the hotfix cannot be deployed immediately, F5 provides a workaround via iRule for the affected virtual server. Customers can obtain it by submitting a support ticket to F5.

CISA has directed agencies to first implement iRule “to enable proactive forensic analysis” and then “install the vendor’s final patch as soon as possible.” Choosing iRule as the first step is intentional: it allows security teams to collect forensic evidence before changing the state of the system.

See also: CVE-2026-60236: Critical RCE in Oracle Coherence (CVSS 9.8) – what to do now

CERT-EU , the cybersecurity service for the EU institutions , also issued an advisory, recommending to first preserve forensic evidence, apply the hotfix, check for signs of a breach , and initiate incident response if found. The CERT-EU advisory was published before F5’s September 23 update, so it described the situation more generally as an access policy and OAuth profile on a virtual server.

Signs of a breach that administrators should look for include repeated OAuth authentication failures followed by suspicious commands, as well as a TMM SIGABRT shortly afterwards.

Specifically, in the APM logs ( /var/log/apm ), administrators should look for repeated failed UserInfo requests with the error message “The access token is invalid” . If 10 or more requests are detected from a single IP address in a short period of time, this is a strong indication of an attack. Additionally, an unexplained increase in total_failed when running the tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed command is also a significant warning.

BIG-IP APM Zero-Day: Broader Context and Impact for Organizations

F5 's BIG -IP is widely used by government agencies, financial institutions, telecommunications companies and large enterprises worldwide, including Europe and Greece. This vulnerability is particularly dangerous because it does not require any authentication . This means that in many cases, the virtual server is accessible from the internet, making the attack even easier.

See also: CVE-2026-56163: Critical EoP in Azure Kubernetes Service (AKS) – Mitigated by Microsoft

Historically, vulnerabilities in BIG-IP have been exploited by state-sponsored APT groups and cybercriminals to gain initial control over corporate networks. The speed with which CISA added CVE-2026-94127 to the KEV list — the same day it was disclosed — suggests that there are already confirmed attacks on real systems. However, F5 and CISA have not disclosed the number of systems affected, the identity of the attackers, or the organizations targeted.

Organizations using BIG-IP APM should take immediate action. The first step is to determine if APM is acting as an OAuth authorization server — if so, they are at risk. Next, they should implement the iRule, review logs for signs of a breach, and install the engineering hotfix as soon as possible. If suspicious activity is detected, it is recommended to immediately activate your incident response plan and notify the appropriate authorities.