Attackers are running code on BIG-IP APM boxes configured as OAuth authorization servers

The traffic that triggers CVE-2026-94127 goes to the virtual server that already receives OAuth traffic, the same BIG-IP address legitimate clients use to get tokens, and specific malicious requests to it lead to code execution ^[29]. "The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure," F5 said in its advisory ^[7]. Locking down the management interface does not protect the system ^[8].

CISA told agencies to apply F5's iRule first "to allow for proactive forensic triage," then to "install the final vendor patch as soon as possible" ^[14]. Customers get the iRule by opening a ticket with F5 support ^[13].

F5 updated its CVE record at 00:45 UTC on September 23 to say the flaw is present only in the authorization server role ^[15]. CISA's KEV entry and an advisory from CERT-EU were published before that change and describe the condition more broadly, as an access policy and an OAuth profile on a virtual server ^[15]. The narrowing arrived with less than two days left on the clock CISA set ^[28]. F5 did not evaluate builds past End of Technical Support ^[26].

Shadowserver tracks more than 14,700 IP addresses carrying BIG-IP APM fingerprints, and it did not say how many are patched or are honeypots ^[16]. "Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability," F5 said ^[6]. The 14,700 is the outer bound of the population to triage, and the query that narrows it is whether an OAuth authorization server profile is bound to an access profile on a virtual server ^[4].

The indicators F5 published are cheap to run. The combination that should send a human to the box is repeated OAuth authentication failures, then suspicious commands, then a TMM SIGABRT shortly after ^[17]. In /var/log/apm, look for failed UserInfo requests with the error description "The access token is invalid.", especially 10 or more from a single IP address in a short time ^[18]. Check total_failed in the output of tmctl global_oauth_stat for an unexplained rise, and read /var/log/audit around the timestamps of those failures ^[19]. TMM core files on their own are not a sign, though F5 has seen TMM enter a loop and the SOD daemon send a SIGABRT ^[20]. CERT-EU's order of operations is preserve forensic evidence, apply the hotfix, check for signs of compromise, and start incident response if any turn up ^[21].

F5 said it discovered the defect internally ^[22]. Its CVE record and CISA's KEV entry do not name the attackers or say how many systems were hit ^[23]. Separately, F5 disclosed in October 2025 that state-sponsored hackers had breached its systems in August 2025 and stolen BIG-IP security source code and vulnerability information ^[24].