BuildNot yet confirmed elsewhere1 publisher2 min readPublished
F5 BIG-IP APM virtual servers with an OAuth Authorization Server profile carry a 9.8 code-execution flaw
F5 published CVE-2026-94127, a CVSS 9.8 heap overflow in BIG-IP APM that lets an attacker run code without credentials. Only virtual servers that pair an access policy with an OAuth Authorization Server profile are exposed, so the configuration check comes first.
The Engineer · Build desk
Three key figures: F5 scores the flaw 9.8 under CVSS v3.1, and 9.3 under CVSS v4.0; the CISA due date of 25 September fell 3 days after the 22 September publication; F5 lists 3 indicators to check for.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Severity score, CVSS v3.1 | 9.8 score | 9.3 under CVSS v4.0 | 2 |
| Publication to CISA due date | 3 days | 17 | |
| Indicators F5 lists | 3 signs | 6 |
What happened
- CISA added the flaw to its Known Exploited Vulnerabilities catalog on the day F5 published, with a due date of 25 September, and F5 says it has learned of exploitation.
- Versions 21.1.0, 17.5.0 to 17.5.1 and 17.1.0 to 17.1.3 are affected, and for each of those branches F5's fix comes as an engineering hotfix.
- F5 names three signs to look for: OAuth requests failing again and again, suspicious commands showing up in logs shortly afterward, and a TMM SIGABRT when the traffic microkernel gets stuck in a loop.
- F5 also scores the flaw 9.3 under CVSS v4.0, classifies it as CWE-122 and tracks it under product development ID 2524777.
Why it matters
- exposure APM deployments acting only as an OAuth client or resource server are not affected, so the first job is to find which role each APM profile plays.
- decision Teams must decide how long the interim iRule carries them: CISA wants forensic triage before the final patch, so the hotfix is the fix but not the first step.
- constraint The KEV due date fell three days after publication, so any triage before patching had to be quick across up to three branches.
F5's advisory K000162605 states the trigger in one sentence, according to the dev.to write-up that quotes it: "When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE)." [9] The same paragraph narrows the condition: "This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server." [14] Rapid7 adds that the flaw is not present in a default configuration [11].
The write-up describes the affected pattern as a company's own gateway issuing tokens to internal applications. On the network that is one virtual server answering internet requests with an OAuth endpoint attached, and the overflow sits on that endpoint. [18]
Both CVSS scores describe the same reach: network access, no privileges, no user interaction [16]. In our view that leaves the configuration condition as the only filter on who is exposed.
F5's impact statement says where the flaw lives: "This vulnerability allows an unauthenticated attacker to perform RCE. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure." [13] Appliance mode closes the underlying operating system to administrators, the write-up says, but it cannot stop a defect the traffic-processing microkernel runs into by itself [12]. Teams that removed shell accounts and restricted the management interface have changed nothing about this flaw, the write-up argues, because the request arrives on the same listener that legitimate application traffic uses [15].
The write-up does not describe what the interim iRule matches. A team would want the advisory text in hand before relying on it.
What to watch
- Whether F5 updates advisory K000162605 with indicators beyond the three it lists now.
- Whether the interim iRule needs changes once the engineering hotfixes are installed on the 21.1, 17.5 and 17.1 branches.
- Any public exploit detail that shows how the OAuth endpoint request triggers the heap overflow.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence64
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
F5 published CVE-2026-94127 on 22 September 2026.
- [2]
F5 rates the flaw Critical at 9.8 under CVSS v3.1 and 9.3 under CVSS v4.0, classifies it as CWE-122 and tracks it under product development ID 2524777.
- [3]
The flaw is a heap-based buffer overflow that lets an attacker run code with no credentials.
- [4]
Exposure sits on one virtual server that needs both an APM access policy and an OAuth Authorization Server profile.
- [5]
The vulnerable branches are 21.1.0, 17.5.0 through 17.5.1 and 17.1.0 through 17.1.3, and F5 ships the fix as an engineering hotfix on each branch.
- [6]
F5 lists three indicators: repeated OAuth failures, suspicious commands logged soon after, and a TMM SIGABRT raised when the traffic microkernel enters a loop.
- [7]
F5's interim iRule holds the traffic pattern down while the hotfix is scheduled, and CISA asks for forensic triage before the final patch goes on.
- [8]
CISA added the flaw to the Known Exploited Vulnerabilities catalog on the day of publication with a due date of 25 September, and F5 states that it has learned the vulnerability has been exploited.
- [9]
"When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE)."
- [10]
F5 states that deployments using APM strictly as an OAuth Client / Resource Server, without OAuth authorization server profiles configured, are not affected by this vulnerability.
- [11]
Rapid7 noted that the flaw is not present in a default configuration and that exploitation requires a virtual server with both an APM access policy and an OAuth profile configured.
- [12]
Appliance mode exists to close the underlying operating system to administrators, and it does nothing about a defect that the traffic-processing microkernel reaches on its own.
- [13]
"This vulnerability allows an unauthenticated attacker to perform RCE. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure."
- [14]
"This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server."
- [15]
A team that has removed shell accounts and restricted the management interface to an operations network has changed nothing about this flaw, because the request arrives on the same listener that legitimate application traffic uses.
- [16]
Both CVSS scores describe the same reach: network access, no privileges, no user interaction.
- [17]
The CISA due date of 25 September fell three days after the 22 September publication.
- [18]
APM configured as an authorization server is the pattern a company uses when its own gateway issues tokens to internal applications; on the network it is one virtual server answering internet requests with an OAuth endpoint attached, and the heap overflow sits on that endpoint.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toF5's BIG-IP APM Heap Overflow Puts Remote Code Execution Behind an OAuth Profile
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- OAuth authorization serversFollow
- Edge gateway vulnerabilitiesFollow
- Known Exploited Vulnerabilities catalogFollow