Affected Systems
F5 BIG-IP Access Policy Manager (APM) versions 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3, when configured as OAuth authorization servers with APM access policy and OAuth authorization server profile on the same virtual server. Systems using APM only as OAuth client or resource server are not affected.
Exploitation Status
Active exploitation confirmed. CISA added CVE-2026-94127 to KEV catalog on September 22, 2026. Specific attacker identity, target organizations, and scale of exploitation not disclosed.
Business Impact
Heap-based buffer overflow (CVSS 9.8 v3.1, 9.3 v4.0) allows unauthenticated remote code execution via malicious traffic to the virtual server. Management interface restrictions do not mitigate this flaw. Appliance mode systems remain vulnerable. Federal agencies required to patch by September 25, 2026.
Urgency
🔴 Immediate
Recommended Actions
- Apply engineering hotfixes immediately: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG (21.1), Hotfix-BIGIP-17.5.1.9.0.160.12-ENG (17.5), or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG (17.1) for affected systems
- If immediate patching is not possible, request and deploy the iRule mitigation from F5 support for affected virtual servers to enable forensic triage
- Check /var/log/apm for 10+ failed UserInfo requests from single IPs with 'access token is invalid' errors; run 'tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed' to identify anomalous spikes
- Review /var/log/audit for suspicious commands correlating with OAuth authentication failures, especially if followed by TMM SIGABRT events
- Preserve forensic evidence before patching; initiate incident response if indicators of compromise are found, as hotfix installation may not revoke attacker access