F5 BIG-IP APM Zero-Day Exploit Allows Remote Code Execution
Critical vulnerability actively exploited in the wild, affecting edge network appliances.
1Critical RCE vulnerability disclosed
F5 Networks disclosed CVE-2026-94127, a critical zero-day vulnerability in BIG-IP APM with CVSS score 9.8. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable systems. Exploitation was confirmed before the September 22 advisory. The vulnerability specifically affects BIG-IP APM deployments configured as OAuth Authorization Servers, while systems using APM only as OAuth Client or Resource Server remain unaffected.
2Attack surface and impact
The vulnerability affects BIG-IP versions 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0. As BIG-IP appliances typically sit at network edges handling authentication, successful exploitation provides attackers a foothold into corporate infrastructure. The flaw resides in the data plane rather than management plane, with appliance mode also vulnerable. F5 confirmed active exploitation in the wild before patching.
3Technical specifics
The vulnerability triggers when APM access policy and OAuth profile are configured on a virtual server. Specific malicious traffic can then lead to RCE. F5 provided indicators of compromise including repeated OAuth authentication failures followed by suspicious commands and TMM SIGABRT events. The company notes this is purely a data plane issue with no control plane exposure.
4Immediate remediation
F5 released hotfixes for affected versions and recommends immediate patching due to active exploitation. For organizations unable to patch immediately, F5 provided a temporary iRule mitigation through support channels. However, this should not replace permanent patching. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to remediate by September 25, 2026.
5Deployment context matters
Not all BIG-IP APM deployments are vulnerable - only those configured as OAuth Authorization Servers. Systems using APM strictly as OAuth Client or Resource Server remain unaffected. Shadowserver currently tracks over 14,700 BIG-IP APM-exposed IPs, though not all may be vulnerable. Organizations must verify their specific OAuth configuration status.
6Detection and response
F5 advises organizations to review logs for signs of exploitation, particularly sequences of OAuth authentication failures followed by suspicious commands. Given confirmed exploitation, patching should be treated as incident response rather than routine vulnerability management. Administrators should also examine whether the vulnerable OAuth configuration is in use.
7Broader implications
The vulnerability's significance stems from BIG-IP's widespread use as network edge protection. Successful exploitation could allow attackers to bypass perimeter security. The active exploitation before patch availability increases urgency. F5's disclosure follows responsible practices by providing both patches and detection guidance simultaneously.
8Security team priorities
For organizations running BIG-IP APM, immediate actions include: determining OAuth configuration status, identifying exposed systems, applying hotfixes, and reviewing logs for compromise indicators. The confirmed exploitation means delay increases risk substantially. Security teams should prioritize this above routine patching cycles given the critical nature.
Original article: Security Affairs — F5 BIG-IP APM Zero-Day Exploit Allows Remote Code Execution