F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

Summary

Attackers are actively exploiting a critical zero-day vulnerability (CVE-2026-94127) in F5 BIG-IP Access Policy Manager (APM) that allows for unauthenticated remote code execution. The flaw specifically affects systems where APM functions as an OAuth authorization server. F5 has released engineering hotfixes and CISA has added it to its Known Exploited Vulnerabilities catalog, mandating immediate action for federal agencies.

Full text

F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers Swati KhandelwalSep 23, 2026Vulnerability / Network Security Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes. APM is the BIG-IP module that controls how users reach an organization's applications and networks. The vulnerable setup has an APM access policy and an OAuth authorization server profile on the same virtual server, which hosts the BIG-IP address that receives the OAuth traffic. Specific malicious traffic sent to that virtual server can lead to remote code execution. The flaw is a heap-based buffer overflow. F5 rates it 9.8 out of 10 on CVSS v3.1 and 9.3 on CVSS v4.0. Because the malicious traffic goes to the virtual server itself, limiting access to the BIG-IP management interface does not protect against this flaw. BIG-IP systems in Appliance mode are also vulnerable. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on September 22. It gave federal civilian agencies until September 25 to apply F5's mitigations, under a directive CISA issued in June. F5's CVE record and CISA's KEV entry do not say how many systems were attacked, who the attackers are, or which organizations were targeted. Who Is Affected For systems where APM acts as an OAuth authorization server, these are the affected versions and the hotfix for each: Branch Affected versions Fixed in 21.1 21.1.0, before the hotfix Hotfix-BIGIP-21.1.0.2.0.30.22-ENG 17.5 17.5.0 to 17.5.1, before the hotfix Hotfix-BIGIP-17.5.1.9.0.160.12-ENG 17.1 17.1.0 to 17.1.3, before the hotfix Hotfix-BIGIP-17.1.3.5.0.41.14-ENG Systems that use APM only as an OAuth client or resource server, with no OAuth authorization server profiles, are not affected. F5 updated its CVE record at 00:45 UTC on September 23 to say the flaw is present only in the authorization server role. CISA's KEV entry and an advisory from CERT-EU, the cybersecurity service for EU institutions, were published before that change. Both describe the condition more broadly, as an access policy and an OAuth profile on a virtual server. In F5's configuration guide for APM 17.1, 17.5 and 21.0, the authorization server's OAuth profile is created under Access > Federation > OAuth Authorization Server > OAuth Profile. It is then selected in an access profile attached to the virtual server. A virtual server set up this way matches the condition F5 describes. F5 did not evaluate versions that have reached End of Technical Support, so their status is unknown rather than safe. Another APM flaw, CVE-2025-53521, was added to CISA's KEV catalog in March. Its fixes for the 17.1 and 17.5 branches, 17.1.3 and 17.5.1.3, fall inside the affected ranges above. A system updated to either build still needs the new hotfix if APM acts as an OAuth authorization server on it. What to Do Now F5's fix is the engineering hotfix listed for each branch in the table. When the hotfix cannot be installed immediately, F5 offers an iRule mitigation for the affected virtual server. Customers get it by opening a ticket with F5 support. CERT-EU advises preserving forensic evidence first, applying the hotfix, checking for signs of compromise, and starting incident response if any are found. CISA told agencies to apply the iRule first "to allow for proactive forensic triage," and then to "install the final vendor patch as soon as possible." Checking for Compromise The signs below are F5's, as listed in CERT-EU's advisory. The combination that should lead to a human review of the system is repeated OAuth authentication failures, followed by suspicious commands, followed by a TMM SIGABRT shortly after. APM log: repeated failed UserInfo requests in /var/log/apm with the error description "The access token is invalid." Look especially for 10 or more requests from a single IP address within a short time. OAuth counter: an unexplained rise in total_failed when running tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed. Audit log: suspicious commands in /var/log/audit around the times of those failures. TMM core files: not a sign on their own, but worth investigating. F5 has seen TMM enter a loop, causing the SOD daemon to send a SIGABRT. F5's CVE record and the CISA and CERT-EU advisories do not say whether installing the hotfix removes access that an attacker already has. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  F5, Identity Security, network security, Vulnerability, Web Security ⚡ Top Stories This Week Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up OpenAI Reveals Six Model Incidents Involving Hidden Failures and Unauthorized Uploads Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It. How to Evaluate a Unified Security Platform Using a One-Incident Test Stop Trying to Control AI Behavior. Control What AI Can Reach ⭐ Featured Resources Validation Summit ’26: See How Pen Testing, Exposure Validation and BAS Work Together Red Teams: Learn How Attack Path Chaining Changes Automated Security Testing Turn Threat Intelligence Into Verified Risk With Threat-Led Penetration Testing Deploy Browser Security Monitoring in Minutes With a Single Header

Indicators of Compromise

• cve — CVE-2026-94127
• cve — CVE-2025-53521

Entities