F5 Patches Critical BIG-IP RCE Flaw Added to CISA KEV Catalog
F5 BIG-IP APM Zero-Day (CVE-2026-94127) Actively Exploited for RCE
Related Entities
Products & Tech
CVE Identifiers
Full Report
Executive Summary
On September 22, 2026, F5 released emergency patches for a critical zero-day vulnerability, CVE-2026-94127, affecting its BIG-IP Access Policy Manager (APM) product. The vulnerability is a heap-based buffer overflow with a CVSS 3.1 score of 9.8, allowing an unauthenticated remote attacker to execute arbitrary code. F5 confirmed that the vulnerability was discovered internally but has since been actively exploited in the wild. In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog and issued a directive requiring U.S. federal civilian agencies to apply patches by September 25, 2026. The vulnerability impacts the data plane, meaning access restrictions to the management interface are not an effective mitigation.
Vulnerability Details
CVE-2026-94127 is a heap-based buffer overflow vulnerability that can be triggered by sending specially crafted malicious traffic to a virtual server on a vulnerable BIG-IP system. The flaw allows an unauthenticated attacker to achieve remote code execution (RCE) on the data plane, giving them control over the affected device.
A key prerequisite for exploitation is a specific, non-default configuration. A BIG-IP system is only vulnerable if a virtual server is configured with both an APM access policy and an OAuth Authorization Server profile. Systems using APM only as an OAuth client or resource server are not affected.
Because the vulnerability exists in the data plane (which handles traffic processing) rather than the control plane (management interface), typical hardening measures like restricting management access do not prevent exploitation. An attacker only needs network access to the exposed virtual server.
Affected Systems
The following versions of F5 BIG-IP are affected:
- 21.1.0
- 17.5.0 - 17.5.1
- 17.1.0 - 17.1.3
Security firm Shadowserver reports that it is tracking over 14,700 internet-exposed BIG-IP APM instances that could be vulnerable if they have the specific required configuration.
Exploitation Status
This is a zero-day vulnerability that is confirmed to be under active exploitation. CISA's addition of CVE-2026-94127 to the KEV catalog underscores the immediate and ongoing threat. The directive for federal agencies to patch by September 25, 2026, highlights the urgency. The nature of the attackers and the scale of the exploitation campaign have not been publicly detailed.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
configuration_settingAccess Policy and OAuth Authorization Server on same virtual serverlog_source/var/log/apmnetwork_traffic_patternprocess_nametmm (Traffic Management Microkernel)tmm process could be a sign of successful or attempted exploitation./var/log/tmm)Detection Methods
Asset Inventory and Configuration Review: The first step is to identify all F5 BIG-IP instances in the environment and check their versions. For each device, review the configuration of all virtual servers to determine if any have both an APM access policy and an OAuth Authorization Server profile applied. This can be done via the management UI or by inspecting the
bigip.conffile.Log Analysis: Ingest and analyze logs from
/var/log/apmand/var/log/tmm. Look for log entries related to OAuth processing errors, unexpectedtmmrestarts, or core dumps. Correlating these events with inbound traffic from suspicious IP addresses can help identify attack attempts. This leverages D3FEND techniques likeSystem Log Analysis.Network-Based Detection: Use IDS/IPS or WAF systems to monitor traffic to the vulnerable virtual servers. While specific signatures may not be available initially, generic rules that detect buffer overflow attempts or unusually large/malformed OAuth requests may provide some detection capability. This aligns with
Network Traffic Analysis.
Remediation Steps
Patch Immediately: The primary remediation is to install the engineering hotfixes provided by F5 for all affected BIG-IP versions. This is a critical action due to active exploitation. This is a direct application of
Software Update.Apply Workaround: For organizations that cannot patch immediately, F5 has provided a workaround in the form of an iRule that can be applied to the vulnerable virtual server. This iRule is available from F5 Support and is designed to block the malicious traffic that triggers the vulnerability. This is a form of
Application Configuration Hardening.Review Configuration: As a temporary measure, if the OAuth Authorization Server profile is not essential for the virtual server's function, removing it will mitigate the vulnerability for that specific server. This should be done with careful consideration of the business impact.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
Applying the vendor-supplied hotfixes is the primary and most effective method to remediate the vulnerability.
Mapped D3FEND Techniques:
Software Configuration
Applying the F5-provided iRule or removing the vulnerable configuration (OAuth Authorization Server profile) serves as a critical workaround.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
The most critical action for organizations with affected F5 BIG-IP APM instances is to apply the engineering hotfixes provided by F5 immediately. Due to active exploitation and its inclusion in the CISA KEV catalog, this should be treated as an emergency change. A risk-based approach should be taken, prioritizing internet-facing and business-critical systems first. Use automated deployment tools to ensure all vulnerable instances are patched and verify the installation to confirm remediation. Given this is a data plane vulnerability, patching is the only way to fully eliminate the risk of RCE; other mitigations only reduce the attack surface.
For organizations unable to patch immediately, two configuration hardening options exist. The first and recommended workaround is to obtain and apply the specific iRule provided by F5 Support. This iRule is designed to inspect incoming traffic and block the malicious requests that trigger the buffer overflow, acting as a virtual patch. The second option is to review the business need for the vulnerable configuration. If a virtual server does not strictly require the combination of an APM access policy and an OAuth Authorization Server profile, removing the OAuth profile will neutralize the threat for that server. This change should be carefully tested to ensure it does not disrupt legitimate application functionality.
Timeline of Events
F5 releases emergency patches for CVE-2026-94127 and confirms active exploitation.
CISA adds CVE-2026-94127 to its KEV catalog.
Deadline for U.S. federal civilian agencies to patch CVE-2026-94127 per CISA directive.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.