Actively exploited F5 BIG-IP APM heap overflow enables unauthenticated RCE at the edge

A critical flaw with confirmed exploitation

F5 disclosed CVE-2026-94127 on 22 September 2026, a heap-based buffer overflow in the BIG-IP Access Policy Manager that carries a Critical rating of 9.8 under CVSS v3.1 and 9.3 under v4.0. According to dev.to, the defect lets an unauthenticated attacker run code on the appliance, and it has already been abused: F5's advisory states the vulnerability has been exploited, and a New York State advisory for the same issue says the vendor confirmed attacks in the wild. CISA placed the flaw in its Known Exploited Vulnerabilities catalog on the day of disclosure, with a remediation deadline of 25 September.

Scope is narrow but security-sensitive

The exposure requires a specific configuration. F5's advisory K000162605 says the flaw appears only on a virtual server that carries both an APM access policy and an OAuth profile, and only where APM acts as the OAuth Authorization Server. Deployments running APM purely as an OAuth client or resource server are not affected, and Rapid7 notes that a default installation does not carry the flaw at all.

That still leaves a meaningful population at risk. Organizations use the authorization server pattern when their own gateway issues tokens to internal applications, keeping logins inside the corporate perimeter and the audited identity system. The result on the network is a virtual server answering internet requests with an OAuth endpoint attached, and a heap overflow sitting on that endpoint.

F5 lists three affected branches: 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3. The company classifies the bug as CWE-122 and tracks it internally under ID 2524777.

Appliance mode offers no protection

The advisory describes the flaw as a data plane issue with no control plane exposure, and explicitly states that systems running in Appliance mode are vulnerable as well. Appliance mode exists to harden the underlying operating system by closing administrative and shell access, but the overflow is reached by the traffic processing microkernel while it handles ordinary requests. Locking down management interfaces changes nothing here, because the malicious request arrives on the same listener that legitimate application traffic uses. Rapid7's operational conclusion, as relayed by dev.to, is that organizations running this configuration at the network edge should prioritize remediation.

Detection indicators defenders can act on

F5's guidance describes exploitation as a recognizable sequence rather than a single event: repeated OAuth authentication failures, followed shortly by suspicious command activity in the audit log, and then a TMM crash. On the failure signal, the advisory suggests that around ten or more log entries from a single IP address deserve review. The closing indicator is a core file produced when the traffic microkernel enters a loop and the SOD daemon aborts it with a SIGABRT. Each signal alone is routine noise on a busy gateway; the ordering is what marks an incident, and the vendor says three indicators observed close together warrant investigation. F5 also points administrators at the global OAuth statistics counters, where an unexplained rise in the failed total is the number to chase.

Patching and interim mitigation

The fix ships as an engineering hotfix on each affected branch: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG for 21.1.0, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG for the 17.5.x line, and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG for the 17.1.x line. Installing a hotfix is a maintenance event, so F5 also published an interim iRule that suppresses the malicious traffic pattern while the patch window is scheduled. According to dev.to, CISA additionally asks for forensic triage before the final patch is applied, so any earlier intrusion is not simply patched over.

Why it matters

This is an unauthenticated remote code execution flaw on internet-facing identity infrastructure, with exploitation confirmed by the vendor and a same-day KEV listing by CISA. Checking exposure is cheap and precise: a team only needs to query whether any virtual server combines an APM access policy with an OAuth Authorization Server profile, and the answer immediately puts the deployment inside or outside the affected set. Hardened Appliance-mode systems get no pass, because the defect lives in the request path rather than the management plane. Finally, the published indicator timeline gives defenders a concrete way to sweep existing logs for past attempts before the hotfix lands, which matters when the vulnerability has already been used in the wild.