F5 Patches Critical BIG-IP RCE Flaw Added to CISA KEV Catalog
F5 BIG-IP APM Zero-Day (CVE-2026-94127) Actively Exploited for RCE
Related Entities(initial)
Organizations
Products & Tech
CVE Identifiers
Full Report(when first published)
Executive Summary
On September 22, 2026, F5 released emergency patches for a critical zero-day vulnerability, CVE-2026-94127, affecting its BIG-IP Access Policy Manager (APM) product. The vulnerability is a heap-based buffer overflow with a CVSS 3.1 score of 9.8, allowing an unauthenticated remote attacker to execute arbitrary code. F5 confirmed that the vulnerability was discovered internally but has since been actively exploited in the wild. In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog and issued a directive requiring U.S. federal civilian agencies to apply patches by September 25, 2026. The vulnerability impacts the data plane, meaning access restrictions to the management interface are not an effective mitigation.
Vulnerability Details
CVE-2026-94127 is a heap-based buffer overflow vulnerability that can be triggered by sending specially crafted malicious traffic to a virtual server on a vulnerable BIG-IP system. The flaw allows an unauthenticated attacker to achieve remote code execution (RCE) on the data plane, giving them control over the affected device.
A key prerequisite for exploitation is a specific, non-default configuration. A BIG-IP system is only vulnerable if a virtual server is configured with both an APM access policy and an OAuth Authorization Server profile. Systems using APM only as an OAuth client or resource server are not affected.
Because the vulnerability exists in the data plane (which handles traffic processing) rather than the control plane (management interface), typical hardening measures like restricting management access do not prevent exploitation. An attacker only needs network access to the exposed virtual server.
Affected Systems
The following versions of F5 BIG-IP are affected:
- 21.1.0
- 17.5.0 - 17.5.1
- 17.1.0 - 17.1.3
Security firm Shadowserver reports that it is tracking over 14,700 internet-exposed BIG-IP APM instances that could be vulnerable if they have the specific required configuration.
Exploitation Status
This is a zero-day vulnerability that is confirmed to be under active exploitation. CISA's addition of CVE-2026-94127 to the KEV catalog underscores the immediate and ongoing threat. The directive for federal agencies to patch by September 25, 2026, highlights the urgency. The nature of the attackers and the scale of the exploitation campaign have not been publicly detailed.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
configuration_settingAccess Policy and OAuth Authorization Server on same virtual serverlog_source/var/log/apmnetwork_traffic_patternprocess_nametmm (Traffic Management Microkernel)tmm process could be a sign of successful or attempted exploitation./var/log/tmm)Detection Methods
Asset Inventory and Configuration Review: The first step is to identify all F5 BIG-IP instances in the environment and check their versions. For each device, review the configuration of all virtual servers to determine if any have both an APM access policy and an OAuth Authorization Server profile applied. This can be done via the management UI or by inspecting the
bigip.conffile.Log Analysis: Ingest and analyze logs from
/var/log/apmand/var/log/tmm. Look for log entries related to OAuth processing errors, unexpectedtmmrestarts, or core dumps. Correlating these events with inbound traffic from suspicious IP addresses can help identify attack attempts. This leverages D3FEND techniques likeSystem Log Analysis.Network-Based Detection: Use IDS/IPS or WAF systems to monitor traffic to the vulnerable virtual servers. While specific signatures may not be available initially, generic rules that detect buffer overflow attempts or unusually large/malformed OAuth requests may provide some detection capability. This aligns with
Network Traffic Analysis.
Remediation Steps
Patch Immediately: The primary remediation is to install the engineering hotfixes provided by F5 for all affected BIG-IP versions. This is a critical action due to active exploitation. This is a direct application of
Software Update.Apply Workaround: For organizations that cannot patch immediately, F5 has provided a workaround in the form of an iRule that can be applied to the vulnerable virtual server. This iRule is available from F5 Support and is designed to block the malicious traffic that triggers the vulnerability. This is a form of
Application Configuration Hardening.Review Configuration: As a temporary measure, if the OAuth Authorization Server profile is not essential for the virtual server's function, removing it will mitigate the vulnerability for that specific server. This should be done with careful consideration of the business impact.
Timeline of Events
Article Updates
September 25, 2026
Updated figures for exposed instances, detailed impact assessment, and new hunting/detection methods for F5 BIG-IP APM zero-day.
The number of internet-exposed BIG-IP APM deployments potentially vulnerable has increased slightly from ~14,700 to over 15,000. The new report provides a more detailed impact assessment, highlighting how compromise can lead to traffic decryption, credential theft, lateral movement (T1207), and service disruption. Additional hunting hints include monitoring BIG-IP LTM logs for 'tmm' crashes, scrutinizing '*/oauth/' URL patterns for malformed requests, and watching for outbound C2 connections from the BIG-IP. Remediation now explicitly includes hunting for compromise before and after patching.
Update Sources:
Timeline of Events
F5 releases emergency patches for CVE-2026-94127 and confirms active exploitation.
CISA adds CVE-2026-94127 to its KEV catalog.
Deadline for U.S. federal civilian agencies to patch CVE-2026-94127 per CISA directive.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.