# F5 BIG-IP APM Zero-Day Exploit Allows Remote Code Execution Critical vulnerability actively exploited in the wild, affecting edge network appliances. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-09-23 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/f2500bd4-9131-4181-9ba0-c37cc6634363 ## Critical RCE vulnerability disclosed F5 Networks disclosed CVE-2026-94127, a critical zero-day vulnerability in BIG-IP APM with CVSS score 9.8. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable systems. Exploitation was confirmed before the September 22 advisory. The vulnerability specifically affects BIG-IP APM deployments configured as OAuth Authorization Servers, while systems using APM only as OAuth Client or Resource Server remain unaffected. ## Attack surface and impact The vulnerability affects BIG-IP versions 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0. As BIG-IP appliances typically sit at network edges handling authentication, successful exploitation provides attackers a foothold into corporate infrastructure. The flaw resides in the data plane rather than management plane, with appliance mode also vulnerable. F5 confirmed active exploitation in the wild before patching. ## Technical specifics The vulnerability triggers when APM access policy and OAuth profile are configured on a virtual server. Specific malicious traffic can then lead to RCE. F5 provided indicators of compromise including repeated OAuth authentication failures followed by suspicious commands and TMM SIGABRT events. The company notes this is purely a data plane issue with no control plane exposure. ## Immediate remediation F5 released hotfixes for affected versions and recommends immediate patching due to active exploitation. For organizations unable to patch immediately, F5 provided a temporary iRule mitigation through support channels. However, this should not replace permanent patching. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to remediate by September 25, 2026. ## Deployment context matters Not all BIG-IP APM deployments are vulnerable - only those configured as OAuth Authorization Servers. Systems using APM strictly as OAuth Client or Resource Server remain unaffected. Shadowserver currently tracks over 14,700 BIG-IP APM-exposed IPs, though not all may be vulnerable. Organizations must verify their specific OAuth configuration status. ## Detection and response F5 advises organizations to review logs for signs of exploitation, particularly sequences of OAuth authentication failures followed by suspicious commands. Given confirmed exploitation, patching should be treated as incident response rather than routine vulnerability management. Administrators should also examine whether the vulnerable OAuth configuration is in use. ## Broader implications The vulnerability's significance stems from BIG-IP's widespread use as network edge protection. Successful exploitation could allow attackers to bypass perimeter security. The active exploitation before patch availability increases urgency. F5's disclosure follows responsible practices by providing both patches and detection guidance simultaneously. ## Security team priorities For organizations running BIG-IP APM, immediate actions include: determining OAuth configuration status, identifying exposed systems, applying hotfixes, and reviewing logs for compromise indicators. The confirmed exploitation means delay increases risk substantially. Security teams should prioritize this above routine patching cycles given the critical nature. ## Sources covering this story - https://securityaffairs.com/199619/security/f5-big-ip-apm-zero-day-exploited-in-zero-day-rce-attacks.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._