F5 BIG-IP APM CVE-2026-94127: Pre-authentication RCE Zero-Day Targeting OAuth Configurations

1. Basic Information

• Original Title: BIG-IP APM OAuth vulnerability
• Published Date: 2026-09-22
• Updated Date: 2026-09-23
• Collection Date: 2026-09-24T08:09:37+09:00
• Source: F5 (CVE Record)
• Severity: critical
• Type: Threat Intelligence
• Target Period: 2026-09-23T08:14:06+09:00 to 2026-09-24T08:09:37+09:00 (Asia/Tokyo)
• Original Reference: BIG-IP APM OAuth vulnerability
• Related Sources: F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks, F5 Security Advisory K000162605, CISA Known Exploited Vulnerabilities Catalog
• Basis for Severity: Active exploitation of pre-authentication RCE has been confirmed. The target is APM configured with an OAuth authorization server. The observation count of over 14,700 IPs introduced by BleepingComputer does not represent vulnerable configurations or unpatched counts.
• Reason for Update: The CVE record provided by F5 was used as the primary source, and the data plane impact scope and fixed builds were added. The distinction between investigation indicators and successful compromise, as well as the Japanese expressions, were revised.

2. Executive Summary

A pre-authentication remote code execution vulnerability exists in the data plane of BIG-IP APM configured as an OAuth authorization server. CISA has confirmed active exploitation and added it to the KEV catalog.

3. Attack Flow

RCE via Specially Crafted Traffic to OAuth Authorization Server

1. An attacker reaches a BIG-IP APM virtual server with an access policy and an OAuth profile.
2. Specially crafted traffic exploits a heap-based buffer overflow without authentication, potentially leading to remote code execution.
3. According to F5 guidance cited by BleepingComputer, indicators of compromise include a combination of multiple OAuth authentication failures, suspicious commands, and a subsequent TMM SIGABRT. This is not a mandatory step for all attacks, and a crash alone does not prove successful code execution.

4. Attacker Position and Execution Location

• Unauthenticated external attacker able to reach the OAuth endpoint of the BIG-IP virtual server
• Entity executing commands on the appliance after compromise

5. Victim and Administrator Perspective

Victims

• May appear as authentication failures or temporary access disruptions

Administrators and SOCs

• Repeated OAuth authentication failures within a short period
• Signs of suspicious commands on the appliance
• Subsequent crash due to TMM SIGABRT
• Unexpected processes, files, or outbound connections

6. Success and Failure Conditions

Success Conditions

• BIG-IP APM configured as an OAuth authorization server
• Access policy and OAuth profile associated with the target virtual server
• Attacker network reachability to the virtual server
• Use of an unpatched build

Failure Conditions and Mitigations

• The fixed builds indicated in the F5 CVE record are Hotfix-BIGIP-21.1.0.2.0.30.22-ENG for the 21.1 branch, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG for the 17.5 branch, and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG for the 17.1 branch. Check F5 Support for installation instructions for the appropriate fixed build.
• If immediate updates are not possible, obtain an iRule from F5 Support and apply it to the affected APM virtual servers.
• Temporarily restrict the use or reachability of affected OAuth authorization servers. Restricting management interfaces alone cannot protect vulnerable data plane paths.

7. What Happens Upon Success

• Remote code execution on the BIG-IP appliance
• Possible disruption of authentication and access gateway services.
• Inference: Potential access to configurations, credentials, and session information
• Inference: Use as a stepping stone to the internal network

8. Observable Logs

Email

• No email vectors reported

Proxy / SWG / DNS

• Repeated requests to the OAuth authorization endpoint
• Connections from BIG-IP to unknown external domains or IPs

Endpoint / EDR

• Suspicious commands, unknown processes, and files on the appliance
• TMM SIGABRT and core dump

Identity / IdP

• Multiple OAuth authentication failures
• Client and request parameters inconsistent with normal user authentication procedures

SaaS / Cloud

• Verify virtual server, access policy, and OAuth profile changes via centralized management or SIEM

Network

• Surge in OAuth authentication failures from the same source
• Timeline sequence: Surge in failures -> command indicators -> TMM reset/crash

9. Attack Success Determination

Confirmed in Public Information

• Active exploitation confirmed (individual execution results not publicly disclosed): F5 reported exploitation in the wild, and CISA added the vulnerability to KEV. Public disclosures do not specify the commands executed, the number of affected customers, or subsequent activity.

10. Investigation Playbook

Trigger

• Affected configuration, surge in OAuth authentication failures, suspicious commands, TMM SIGABRT

Initial Verification

• Check BIG-IP version/build, OAuth role, virtual server, access policy, and profile
• Preserve F5 audit, access, and TMM logs along with core dumps
• Retrieve network observation data around the time of the initial anomaly

Endpoints and Servers

• Check appliance filesystem, processes, scheduled tasks, configuration changes, and support diagnostic data using vendor procedures

Authentication and Cloud

• Investigate anomalies in OAuth clients, tokens, sessions, administrator accounts, and device certificates
• Rotate and revoke secrets whose compromise cannot be ruled out

Subsequent Operations

• Search for internal discovery, credential access, configuration exports, tunnel creation, and outbound C2

Containment

• Restrict affected virtual servers and apply patches or iRules
• If compromise indicators are present, isolate the appliance and consult F5 Support to determine whether to rebuild

Determination Criteria

• Corroborate each stage with separate evidence: exploit requests, attacker code execution, credential/session theft, and internal intrusion.

11. Defense and Detection Ideas

Single Event

• Abnormal OAuth parameters and authentication failures
• TMM SIGABRT
• Unknown commands and processes on the appliance

Timeline Correlation

• Correlate repeated OAuth authentication failures, suspicious command indicators, and a subsequent TMM crash. Tune the correlation window to your environment.

Threat Hunting

• Inventory all virtual servers operating as OAuth authorization servers and search for correlation patterns dating back prior to September 23

Log Gaps

• BIG-IP local logs alone lack the full picture of commands and network activity, requiring remote syslog, flows, and packet captures

Priority Countermeasures

• Emergency patch
• Reduction of affected configurations
• an iRule supplied by F5 Support
• Remote log forwarding
• Outbound traffic control on the appliance

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-94127 is a pre-authentication remote code execution vulnerability in BIG-IP APM, and F5 has confirmed active exploitation.
• It affects instances where APM is configured as an OAuth authorization server and has an access policy and OAuth profile associated with a virtual server.
• Configurations operating solely as an OAuth Client or Resource Server are stated not to be affected by this vulnerability.
• F5 guidance cited by BleepingComputer lists a combination of multiple OAuth authentication failures, suspicious commands, and a subsequent TMM SIGABRT as investigation indicators.
• If patches cannot be applied immediately, mitigation guidance was provided to apply an iRule supplied by F5 Support to affected virtual servers.
• According to BleepingComputer, Shadowserver has identified over 14,700 BIG-IP APM IPs. This number does not indicate the target configuration, patch status, or honeypot ratio.
• According to F5's CVE record, The vulnerability is exposed through the data plane, not through a control-plane interface. This does not establish the limits of post-compromise impact. Appliance mode is also affected. Versions that have reached EoTS are out of scope for evaluation.
• The fixed builds are Hotfix-BIGIP-21.1.0.2.0.30.22-ENG for the 21.1 branch, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG for the 17.5 branch, and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG for the 17.1 branch.
• CISA's CVE additional info records the KEV addition and active exploitation on September 22, 2026.

Inference

• Prioritizing the inventory of internet-reachable OAuth authorization server configurations narrows down the response scope better than relying solely on product ownership counts.
• Because a TMM crash alone cannot identify the root cause, decisions should be made by correlating OAuth authentication failures, suspicious commands, and evidence of files or processes.

Hypothesis

No additional hypotheses. Unverified items are listed in "Unknowns and Additional Investigation".

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	Pre-authentication exploit request to public OAuth endpoint.

14. Unknowns and Additional Investigation

• Number of active exploitations, threat actors, and payloads
• Commands executed by attackers and post-compromise activity
• Proportion of the over 14,700 observed IPs that have vulnerable configurations and are unpatched
• Impact of EoTS versions and application procedures for fixed builds suitable for each environment

15. Impact on SOCs and Organizations

Organizations utilizing BIG-IP APM for remote access or OAuth integration must immediately verify not only their product versions, but also the presence of authorization server configurations. SOCs should correlate OAuth authentication failure, command indicators, and TMM crashes as a single incident and conduct an emergency investigation even without proof of success.

16. Summary by Target Audience

SOC

Correlate surges in OAuth authentication failures, suspicious commands, and TMM crashes, and trace subsequent communications from the appliance to the internal network.

Administrators

Identify affected OAuth configurations and apply patches, or if difficult, apply an iRule supplied by F5 Support and network restrictions.

General Users

As issues cannot be resolved by general user actions, contact your IT administrator or support team if access disruptions or re-authentication requests persist.