F5 BIG-IP APM CISA KEV Active Exploit

The OAuth UserInfo door on your F5 APM is open

Sep 25, 2026·9 min·Chris Boker, Founder, CVEasy AI
An oversized HTTP Authorization header pours into a fixed 0x4100 heap buffer inside a BIG-IP APM appliance, overwrites a neighbouring callback pointer, and fires a return oriented program that ends in remote code execution, with a CISA KEV band running through the appliance

F5 published K000162605 on September 22, 2026 for CVE-2026-94127, a heap based buffer overflow in the BIG-IP APM OAuth UserInfo handler that yields unauthenticated remote code execution. CISA added the CVE to Known Exploited Vulnerabilities the same day with a federal remediation deadline of September 25, 2026, which is today. F5 confirmed exploitation in the wild before the advisory shipped, which is the truest zero day pattern the industry sees.

The endpoint the attacker is calling

The vulnerable path is /f5-oauth2/v1/userinfo, the default route on any BIG-IP APM virtual server that has an APM access policy plus an OAuth profile and where APM is configured as the OAuth Authorization Server. UserInfo is the OpenID Connect endpoint a relying party hits with a bearer access token to fetch the profile of the authenticated user, so the handler runs on unauthenticated input by design: the bearer check is what the handler does, not something in front of it. Any host that can reach the affected virtual server on its data plane VIP reaches the vulnerable code with a single HTTP request and no cookie, no session, and no MFA prompt in between.

A 0x4100 heap buffer that never checks its size

Public analyses converge on the same primitive. The handler allocates a fixed 0x4100 byte heap buffer for the Authorization header value and copies the header into it without checking whether the header fits. An attacker who controls the header controls the write. Past the boundary the write walks into a neighbouring object that holds a callback pointer, the overflow rewrites it, and the next call through that pointer is now attacker directed. Rapid7 and Picus Security both describe a stack pivot and a return oriented programming chain built on top of that corrupted pointer, which is what turns the overflow into arbitrary code execution inside TMM.

Why the bug is inevitable in hindsight: A fixed size buffer for a client controlled header, on a handler that has to accept anonymous input to do its job, with no length check in the copy path. Well behaved OAuth clients send short bearer tokens and the buffer is never stressed. An attacker sends a header long enough to reach the callback pointer that lives next door in the same arena and the appliance runs their code.

Locking down management does not save you

BIG-IP guidance for the last decade has trained operators to guard the management interface with hardened ACLs and jump hosts. This bug does not touch the management plane. The vulnerable request hits the virtual server on its data plane VIP, the same address a legitimate OAuth relying party would call, and F5 flags this explicitly in K000162605. Appliance mode is affected too, because the constraint Appliance mode adds is on shell access, not on the OAuth handler. If your APM instance fronts SaaS federation, partner SSO, or an authorization step inside a customer facing API, the attacker reaches this handler through your public edge with the same freedom a real client would have.

Why the scanner and the CVSS queue miss the box that matters

F5 rates the flaw CVSS 9.8 and the advisory pinpoints the vulnerable configuration: APM access policy, OAuth profile, and OAuth Authorization Server role on the virtual server. That 9.8 label is uniform across every BIG-IP APM box you scan. Your estate is not. On an APM appliance that terminates web SSO but does not act as an OAuth authorization server, the exposed handler does not exist and 9.8 overstates the exposure. On the appliance that plays OAuth Authorization Server for a customer identity plane, that same 9.8 understates it: a public endpoint on a device that holds signing keys and directory bindings with a proven preauth code execution primitive is a very different finding from a version match on a lab box. Generic scanners read the TMOS version and light up on the version alone, so the queue either fills with noise or misses the appliance that would take the identity plane with it if it got popped.

How TRIS ranks CVE-2026-94127 per box, not per label

TRIS is the Threat and Risk Intelligence Scoring engine inside CVEasy AI. It walks four layers against your inventory for each finding and produces a per box answer rather than a per CVE label.

Exploitation evidence. F5 asserts in the wild exploitation ahead of the advisory, and CISA added CVE-2026-94127 to KEV on September 22 with a three day federal deadline landing today. Independent write ups from Cybersecurity News and Security Affairs describe the ROP primitive. A demonstrated PoC in a lab is a different signal from confirmed in the wild abuse on production traffic, and TRIS keeps that distinction rather than collapsing both into one badge; on this CVE both signals are on the table at once.

Reachability from the exposure surface. The finding only lights up on a virtual server that has an APM access policy plus an OAuth profile with APM configured as the OAuth Authorization Server. TRIS reads the running configuration off the box in addition to the TMOS build, so a BIG-IP APM edge that terminates web SSO but does not play OAuth Authorization Server drops out of the top band. An internet exposed VIP with the vulnerable role turned on stays at the top.

Blast radius given a foothold. Code execution inside TMM collapses the identity plane behind the appliance. The device holds OAuth signing keys, active session state, backend service accounts, and network reachability into whatever it was designed to front. Two exposed BIG-IP APM boxes with the same CVE can differ by an order of magnitude on this axis based on what they actually front, and TRIS keeps that split visible.

Fix availability against the running build. F5 published engineering hotfixes for 21.1.0, 17.5.0, 17.5.1, and 17.1.0 through 17.1.3, cross referenced by SecPod and SecurityOnline. Boxes on branches outside those ranges show clean on the CVE, but the same query surfaces the appliance that is out of support and has no vendor patch coming.

The same CVE lands at top band ACT on an internet exposed OAuth authorization server, one band lower on a lab appliance with no production identity, and clean on a BIG-IP APM box without OAuth Authorization Server enabled. A CVSS first queue cannot produce that split.

Hotfix, iRule, and the hunt inside /var/log/apm

Install the F5 engineering hotfix for your branch. K000162605 names the hotfix identifier per branch for 21.1.0, 17.5.0, 17.5.1, and 17.1.0 through 17.1.3. If you cannot install the hotfix before the KEV deadline runs out, open a case with F5 Support for the CVE-2026-94127 iRule and attach it to the affected virtual server; the iRule guards the OAuth UserInfo path while you stage the upgrade. Reducing management interface access does not help on this bug, so do not treat that control as a substitute for either the hotfix or the iRule.

Hunt before you close the ticket. In /var/log/apm, look for repeated failed OAuth UserInfo requests from a single source IP, especially bursts of ten or more against the same virtual server. Run tmctl global_oauth_stat and watch total_failed on the affected VIP; a rise that does not correlate with a client rollout is a signal. Correlate against /var/log/audit for unexpected shell activity during the same window, and check for new TMM core files under /var/shared/, since the ROP path can crash TMM on unreliable attempts before it lands.

If the log signal is there, rotate what a shell on TMM could have taken. OAuth signing keys for any authorization server this appliance fronts, client secrets shared with relying parties that trust it, backend service account credentials the appliance carries, and any session material an attacker could have exfiltrated during a compromise window. If exploitation is likely, treat the identity trust the box carried as breached and reissue rather than waiting for confirmation.

How CVEasy AI surfaces this

CVEasy AI is the number one local first CTEM (Continuous Threat Exposure Management) platform. When F5 publishes an advisory like K000162605 and CISA adds the CVE to KEV, the ingest picks up the affected branches, the hotfix identifiers, and the exploitation signal, and TRIS runs the four layer scoring against the BIG-IP inventory already on your hardware. A virtual server that plays OAuth Authorization Server on an internet exposed VIP gets a top band ACT with a workflow that names the branch hotfix, cites the iRule as an interim, and pre stages the hunt queries against /var/log/apm and tmctl. A BIG-IP APM box that never had OAuth Authorization Server enabled gets a lower band with a version note and a config check the on call can close in minutes. The inventory stays on your hardware; the answer to which BIG-IP you patch before the KEV clock runs out does not travel through a cloud SaaS.

Sources: F5 K000162605, CISA KEV, The Hacker News, BleepingComputer, Picus Security, Cybersecurity News, Security Affairs, SecPod, SecurityOnline

One CVE, two identical badges, two very different fires

CVEasy AI's TRIS engine reads the running configuration off each BIG-IP APM box, scores CVE-2026-94127 against real exposure, and tells your on call which appliance to patch before the KEV deadline runs out.

Get CVEasy AI → CISA KEV Deep Dive →

Related Reading

CISA KEV
CISA KEV: What Federal Deadlines Actually Mean for Private Sector
Why the KEV catalog is the exploitation signal the rest of the industry follows.
Edge Appliance
CitrixBleed 2: NetScaler SAML Overread and the Data Plane Bug
Another edge appliance whose data plane parser handed attackers the identity keys.
CTEM
The CTEM Framework: Continuous Threat Exposure Management
Five stage exposure management loop across scope, discovery, prioritization, validation, and mobilization.