Actively Exploited Before the Patch Shipped
F5 disclosed and patched a critical zero-day vulnerability in BIG-IP Access Policy Manager (APM) that attackers were already exploiting for unauthenticated remote code execution. The flaw, tracked as CVE-2026-94127, carries a CVSS score of 9.8 and was published in F5 security advisory K000162605 on September 22, 2026.
F5 says it discovered the issue internally and has since confirmed it "has been exploited," though no public proof-of-concept has surfaced. CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog the same day and ordered federal civilian agencies to secure affected systems by Friday.
Vulnerability Summary
| Field | Details |
|---|---|
| CVE ID | CVE-2026-94127 |
| CVSS Score | 9.8 (Critical) |
| Vulnerability Type | Heap-based buffer overflow (CWE-122) leading to RCE |
| Advisory | F5 K000162605 |
| Exploitation Status | Confirmed exploited in the wild |
| CISA KEV | Added September 22, 2026 |
What's Actually Vulnerable
The bug only triggers on a specific configuration: a virtual server that has both a BIG-IP APM access policy and an OAuth profile configured, running as an OAuth Authorization Server. Specially crafted traffic sent to such a virtual server can corrupt memory and lead to code execution on the data plane.
F5 is explicit that deployments using APM strictly as an OAuth Client or Resource Server — without an OAuth authorization server profile configured — are not affected. Appliance mode is in scope; this is a data-plane issue, not a control-plane one.
Exposure and Response
Shadowserver tracks more than 14,700 internet-exposed BIG-IP APM instances. CISA's advisory called this class of flaw "a frequent attack vector for malicious cyber actors" and warned of significant risk to federal networks specifically.
F5 has shared indicators of compromise and an iRule mitigation for organizations that can't patch immediately, available to customers with an active F5 Support contract. Watch for:
- Multiple failed OAuth authentication attempts
- Followed by suspicious commands
- Followed shortly by a TMM SIGABRT crash
Mitigation
- Apply F5's patch immediately per advisory K000162605.
- If patching isn't immediately possible, deploy F5's iRule mitigation to allow for proactive forensic triage, then patch as soon as possible.
- Audit virtual server configurations for the combination of APM access policy + OAuth authorization server profile — this is the specific exposure condition.
- Review logs for the IoCs above, particularly TMM crash events following OAuth failures.
- Federal agencies: remediate per CISA's KEV deadline.
Broader Context
This is another entry in a difficult run for F5: the company disclosed a 2025 breach in which attackers stole undisclosed BIG-IP source code and vulnerability data, and BIG-IP products have repeatedly drawn attention from both state-backed and criminal threat actors since. Organizations running BIG-IP APM should treat configuration review and patching here as an urgent priority, not routine maintenance.