Unauthenticated BIG-IP APM flaw CVE-2026-94127 under active exploitation, F5 confirms

Unauthenticated code execution in BIG-IP APM

F5 has disclosed CVE-2026-94127, a critical flaw in the BIG-IP Access Policy Manager that the vendor scores 9.8 out of 10 under CVSS v3.1 and says is already being exploited. According to a technical walkthrough published on dev.to, exploiting it requires no credentials, no stolen session and no interaction from a logged-in user: an attacker only needs network reachability to a BIG-IP virtual server with an APM access policy and an OAuth profile attached.

That pairing is not an exotic misconfiguration. The write-up notes that organisations using BIG-IP APM for single sign-on and OAuth-based access control present exactly this shape, because it is how the product is designed to be deployed. Finding candidates is a reconnaissance problem rather than an insider problem: the author reports that a ZoomEye search for BIG-IP and APM markers returned 59,063 internet-visible instances. That figure reflects deployment scale, not confirmed vulnerable systems, since some assets will be patched or will lack the required policy-and-profile combination.

The bug lives in the data plane

At the technical level, the flaw is a heap-based buffer overflow. The code that processes OAuth profiles writes attacker-influenced data into a heap allocation without first verifying that it fits, and the oversized write corrupts adjacent memory. Heap corruption of this kind is a well-established route to code execution, because an attacker who can shape what lands in the damaged region can influence what the process does when it next uses the affected structures.

Two properties make the flaw hard to contain with common hardening. First, the vulnerable code runs in the Traffic Management Microkernel (TMM), the process that handles traffic for the appliance's virtual servers. F5 states, as relayed in the dev.to analysis, that this is a data plane issue with no control plane exposure, meaning attackers trigger it by sending traffic to a virtual server rather than by touching the management interface. Networks that isolate the management plane on a dedicated segment therefore remain exposed, and appliance mode offers no relief because it restricts administrative operations rather than traffic handling.

Code execution inside TMM is not a limited foothold. The compromised process can observe and modify traffic passing through the appliance, open connections to internal services that accept traffic from the BIG-IP, and serve as a staging point for lateral movement, inheriting the trust that internal services extend to their gateway. Because TMM serves multiple virtual servers, one exploited appliance can put every application routed through it at risk.

Affected versions and remediation

F5 lists BIG-IP 21.1.0, BIG-IP 17.5.0 through 17.5.1, and BIG-IP 17.1.0 through 17.1.3 as affected; other BIG-IP modules and NGINX products are said to be unaffected. The vendor has released engineering hotfixes for each branch, identified as Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG, and administrators are advised to verify exact hotfix levels against the advisory rather than relying on the branch number alone. Where an upgrade cannot happen immediately, F5 Support can supply an emergency iRule, which should be treated as a stopgap and removed once the hotfix is installed.

For interim protection, the dev.to analysis recommends restricting which source networks can reach virtual servers that combine an APM access policy with an OAuth profile, removing OAuth profiles from virtual servers that do not need them, and watching OAuth authentication logs for repeated failures that suggest probing. After patching, previously exposed appliances should be inspected for unauthorised configuration changes. SecurityOnline.info also covered the flaw on September 22, 2026.

Why it matters

Because exploitation is confirmed and the attack needs no authentication, remediation and compromise assessment have to run together: upgrading an appliance that an attacker already controls does not evict them. The flaw also shows that data-plane bugs bypass the management-network segmentation that most teams rely on to protect infrastructure gear, and that a single compromised gateway can expose every application behind it. Teams running affected BIG-IP versions with APM should inventory OAuth-enabled virtual servers now, apply the appropriate hotfix, and audit for signs of prior access.