Organizations running F5 BIG-IP Access Policy Manager have an urgent patching and threat-hunting task after the vendor disclosed a critical vulnerability already being used in attacks. The flaw, tracked as CVE-2026-94127, can allow a remote, unauthenticated attacker to run code on a vulnerable appliance by sending specially constructed traffic. F5 assigned the issue an internal identifier of 2524777 and released its advisory on September 22 after determining that exploitation was underway.

The weakness is a heap-based buffer overflow in the traffic-processing layer. It carries a CVSS 3.1 score of 9.8 and a CVSS 4.0 score of 9.3, reflecting the fact that an attacker can reach it over the network without credentials or user interaction. Successful exploitation could affect the confidentiality, integrity and availability of a system positioned at a sensitive point in an enterprise network.

Exposure depends on a specific OAuth configuration

Not every BIG-IP APM installation is vulnerable. The dangerous combination is a virtual server with an APM access policy and an OAuth profile where APM operates as the OAuth Authorization Server. Systems that use APM only as an OAuth client or resource server, without an authorization-server profile, are outside the affected configuration described by F5.

That distinction should drive inventory work, but it should not encourage administrators to rely on incomplete asset records. Appliance-mode deployments can still be affected. The vulnerable component also sits in the data plane, which handles application traffic, rather than the administrative control plane. Restricting access to the management interface therefore does not prevent malicious requests from reaching an exposed virtual server.

F5 lists BIG-IP APM 21.1.0, releases 17.5.0 through 17.5.1, and releases 17.1.0 through 17.1.3 as vulnerable. Products evaluated as unaffected include BIG-IQ, BIG-IP Next, F5 Distributed Cloud services, NGINX products, F5OS variants and F5 AI Gateway. Versions past the end of technical support were not evaluated, so their omission should not be read as confirmation that they are safe.

Hotfixes and temporary mitigation

Engineering hotfixes are available for each supported branch: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG.iso. Administrators should validate the appropriate package with F5 guidance and deploy it as quickly as their change process permits.

If an emergency update cannot be installed immediately, customers can contact F5 Support for an iRule intended to reduce exposure on the affected virtual server. That option should be treated as a temporary risk-reduction measure, not a replacement for the vendor fix. Teams should also consider removing the vulnerable OAuth role from internet exposure where business requirements allow.

How defenders can look for exploitation

Patching closes the immediate route, but it does not establish whether attackers arrived earlier. F5 recommends looking for a cluster of related events rather than treating a single log entry as proof of compromise:

• Repeated OAuth invalid-token or authentication failures in /var/log/apm, especially ten or more from one source address.
• Suspicious commands recorded near the same time in /var/log/audit.
• A Traffic Management Microkernel crash followed by a SIGABRT event and possible core file.

Operators can use tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed to review relevant request and failure counts. An authentication error or TMM core file can occur for benign reasons, so analysts should correlate timestamps, source addresses and command activity before drawing conclusions. Logs and core artifacts should be preserved if the sequence appears suspicious.

Prioritize exposed authorization servers

CISA has added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog, reinforcing that this is an active incident-response issue rather than a theoretical bug. Public reporting has not yet identified the operators, the scale of exploitation or their post-compromise goals. That uncertainty makes rapid containment and retrospective investigation equally important.

Security teams should inventory every APM-backed virtual server, confirm its OAuth role, install the correct hotfix and review recent telemetry for the indicators described by F5. Because BIG-IP systems often broker access to important applications, suspected compromise should trigger credential review, downstream log analysis and examination of any systems reachable through the appliance.