F5 BIG-IP APM heap overflow (CVE-2026-94127) exploited in the wild

Affected Systems

F5 BIG-IP APM versions 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0 when configured with an access policy and OAuth profile on a virtual server. Unauthenticated remote code execution possible.

Exploitation Status

Active exploitation confirmed by F5 and CERT-EU. Attackers are leveraging the heap-based buffer overflow to achieve remote code execution on vulnerable devices.

Business Impact

Critical risk for organizations running affected BIG-IP APM configurations with OAuth profiles. Successful exploitation grants unauthenticated attackers full system control (CVSS 9.8). Immediate compromise assessment required to detect prior intrusion. Exposed APM instances are high-value targets for initial access and lateral movement.

Urgency

🔴 Immediate

Recommended Actions

• Apply F5 hotfixes immediately for BIG-IP APM versions 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0 per advisory K000162605
• If patching is delayed, contact F5 support to obtain and deploy the iRule-based mitigation for affected virtual servers
• Search /var/log/apm for 10+ OAuth authentication failures (error 01990004:3, invalid_token) from single IPs in short timeframes
• Run 'tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed' and investigate unexplained spikes in total_failed
• Review /var/log/audit for suspicious commands near OAuth failure timestamps and check for TMM SIGABRT core files indicating exploitation attempts