Actively exploited heap overflow in F5 BIG-IP APM enables unauthenticated remote code execution

F5 disclosed a critical vulnerability in BIG-IP Access Policy Manager on September 22, 2026, and stated that it is already being exploited. Tracked as CVE-2026-94127 and rated 9.8 under CVSS v3.1, the flaw is a heap-based buffer overflow that allows an unauthenticated remote attacker to execute code on a BIG-IP appliance. The details below come from a dev.to writeup of F5's advisory.

How the flaw works

According to the dev.to analysis, BIG-IP separates configuration handling (the control plane) from client traffic processing (the data plane), with the Traffic Management Microkernel, or TMM, implementing the data plane. CVE-2026-94127 sits in that data plane: F5 reportedly found no control plane exposure, so the bug is reached through ordinary traffic rather than the management interface.

The defect lies in how OAuth profiles are handled. Attacker-influenced input is written into a heap allocation without a proper size check, so the write runs past the end of the buffer and corrupts adjacent heap memory. An attacker who can shape what lands in the corrupted region can influence control flow inside TMM, turning memory corruption into arbitrary code execution.

Two factors widen the exposure. No authentication is needed: the trigger is traffic arriving at a virtual server that has both an APM access policy and an OAuth profile attached. And F5's Appliance mode provides no protection, since it restricts administrative operations rather than how traffic is processed.

Which systems match the pattern

The dev.to writeup lists four conditions that make a deployment vulnerable:

• APM is provisioned on the BIG-IP system.
• A virtual server has an APM access policy attached.
• An OAuth profile is configured on that virtual server.
• The virtual server is reachable over the network.

That combination is the standard way APM is deployed for single sign-on and OAuth-based access control, so many organizations will meet all four conditions by design. F5 lists the affected releases as BIG-IP 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3, and says other BIG-IP modules and NGINX products are unaffected. The writeup cautions that a branch number alone does not tell you whether the fix is present, so operators should check exact hotfix levels against the advisory.

The blast radius

Because TMM handles traffic for all of an appliance's virtual servers, code execution there goes well beyond a single application. The dev.to article notes that an attacker could observe or modify traffic in transit, connect to internal services that trust the BIG-IP, and use the appliance as a pivot for further movement. For organizations whose BIG-IP pair is the primary ingress point, one exploited appliance can expose essentially the entire external attack surface, and internal trust in the gateway amplifies the damage.

For scale context, a ZoomEye query described in the writeup found 59,063 internet-visible assets whose HTTP responses contained both BIG-IP and APM markers. The author is careful to frame this as a deployment footprint, not a list of compromised systems: a matched asset may be patched, may lack the OAuth-plus-access-policy combination, or may sit behind additional controls.

How to fix it

F5 has published engineering hotfixes for the affected branches: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. Organizations that cannot upgrade immediately can request an emergency iRule from F5 Support, which the writeup describes as a temporary measure to be removed once the hotfix is installed.

Additional steps suggested while remediation is underway:

• Restrict which source networks can reach virtual servers combining an APM access policy with an OAuth profile.
• Monitor OAuth authentication logs for repeated failures.
• Remove OAuth profiles from virtual servers that do not need them.
• After upgrading, inspect previously exposed unpatched appliances for unauthorized configuration changes.

Why it matters

A 9.8-rated, unauthenticated remote code execution flaw in a device whose job is to sit in the traffic path is close to a worst case for enterprise networking, and F5's advisory says exploitation has already begun. BIG-IP appliances commonly terminate TLS and broker access to internal systems, so a compromise is not contained to the box: decrypted traffic, credentials and trusted backend services are all within reach. With hotfixes available and an emergency iRule as a stopgap, patching exposed APM-plus-OAuth deployments should be treated as an immediate priority rather than routine maintenance.