The critical remote code execution vulnerability was added to CISA’s KEV, with more than 15,000 deployments potentially at risk.
Technology company F5 fixed a critical remote code execution vulnerability in its BIG-IP Access Policy Manager (APM) platform on Tuesday. The flaw impacts deployments configured as OAuth authorization servers and was already under active exploitation in the wild before the patch became available.
BIG-IP APM is a software component in F5’s BIG-IP hardware platform that enables companies to control access to internal network resources. APM performs various client-side checks and handles authorization and authentication, along with providing VPN connectivity for remote users.
The flaw, tracked as CVE-2026-94127, is described as a heap-based buffer overflow and is rated 9.8 on the CVSS scale. The vulnerability impacts the BIG-IP system when configured in appliance mode as well but can be exploited only when both APM and an OAuth authorization server profile are configured.
Deployments using APM only as an OAuth client or resource server are not affected, F5 said in its advisory. The company advises users to apply Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso for the 21.x for the 21.x release branch and Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso or Hotfix-BIGIP 17.1.3.5.0.41.14-ENG.iso for the still supported 17.5.x and 17.1.x branches.
In addition to the fixes, F5 also released an iRule that can be obtained from the support portal and can be deployed as mitigation until the patch gets applied.
Check for OAuth failures
The US Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday, signaling confirmed active exploitation in the wild. The Shadowserver Foundation tracks more than 15,000 BIG-IP APM deployments exposed to the internet, with North America and Europe accounting for around 5,000 each.
F5 advises customers to check installations for several indicators of compromise that require correlation as the presence of just one is not necessarily a sign of exploitation.
“At a high level, multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT is the combination that should lead to human review of the system,” the company said.
OAuth authentication failures are not unusual, but a repetition of more than 10 such messages in the logs, especially originating from the same IP address, should be reason for further investigation. The following command can reveal the number of authentication failures: tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed
If suspicious counts of OAuth messages are noticed, administrators should review the information recorded around those timestamps in /var/log/audit, as well as the presence of TMM core files because exploitation can cause the TMM to enter a loop and crash, generating such files.
BIG-IP APM and other F5 devices and appliances have been targeted by attackers over the past few years as part of a larger trend of compromising network edge devices and VPN gateways as an entry point into corporate networks. Just earlier this month, security researchers uncovered a Linux rootkit implant specifically designed for BIG-IP APM systems that was linked to exploitation of an older vulnerability, CVE-2025-5352.
