Executive Summary

    On September 22nd, 2026, F5 published an advisory for a critical vulnerability in BIG-IP Access Policy Manager (APM) and confirmed active exploitation in the wild. Tracked as CVE-2026-94127, the flaw lets an unauthenticated, remote attacker send crafted traffic to an affected virtual server and execute code on the appliance.

    BIG-IP APM sits at the network edge and brokers remote access to internal applications, which makes a compromised appliance both a foothold and a position to observe or redirect user traffic. F5 notes that systems running in Appliance mode are also affected, and only virtual servers configured with both an APM access policy and an OAuth profile are vulnerable.

    Given confirmed exploitation in the wild, unauthenticated network accessibility, and the sensitive data these systems protect in enterprise environments, Beazley Security recommends affected organizations apply available fixes as soon as possible.

    Affected Systems or Products

    Only BIG-IP systems with both an APM access policy and an OAuth profile configured on a virtual server are vulnerable. Other BIG-IP modules, BIG-IQ, F5OS, NGINX products, and F5 Distributed Cloud services are not affected.

    Product

    Affected Versions

    Fixed In

    BIG-IP APM 21.x

    21.1.0

    Hotfix-BIGIP-21.1.0.2.0.30.22-ENG

    BIG-IP APM 17.x

    17.5.0 - 17.5.1

    Hotfix-BIGIP-17.5.1.9.0.160.12-ENG

    BIG-IP APM 17.x

    17.1.0 - 17.1.3

    Hotfix-BIGIP-17.1.3.5.0.41.14-ENG

    F5 evaluated only versions that have not reached End of Technical Support. Organizations running end-of-support releases should assume exposure and upgrade.

    Mitigations / Workarounds

    Because exploitation in the wild has been confirmed, Beazley Security recommends patching as the best mitigation. If patching cannot be immediately performed, the following may help to temporarily reduce risk:

    • Prioritize virtual servers that have both an APM access policy and an OAuth profile attached as the combination is the precondition for exploitation of this flaw.

    • Contact F5 Support to obtain the vendor-supplied iRule mitigation, and apply it to the affected APM virtual servers.

    • Preserve forensic evidence, including TMM core files and APM and audit logs, before making configuration changes or rebooting.

    Patches

    F5 has released engineering hotfixes for the affected 17.x and 21.x branches, available from F5 Downloads. Full version details and diagnostic guidance are in the F5 advisory and can be found here.

    Indicators of Compromise

    On September 22nd, 2026, CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. F5 has stated the vulnerability has been exploited but has not published attacker infrastructure or tooling indicators. No public proof-of-concept exploit is known at the time of writing.

    F5 describes the attack chain as three events occurring close together: repeated OAuth authentication failures, followed by suspicious commands, followed by a crash of the Traffic Management Microkernel (TMM).

    Defenders can review the APM logs in /var/log/apm for repeated UserInfo request failures carrying an invalid token error. Isolated occurrences are normal, so the signal may not always indicate successful exploitation: 

    <DATE> <HOST> err tmm1[30975]: 01990004:3: <PROFILE_NAME>: Request UserInfo from Source ID (null) IP <IP> failed. Error Code (invalid_token) Error Description (The access token is invalid.)

    When a cluster of failures are observed, timestamps in the audit logs in /var/log/audit can be correlated around that window for suspicious commands. F5 has observed the TMM entering a loop that causes the SOD daemon to abort the process, so a core file alongside the log activity above could warrant further investigation.

    Technical Details

    OAuth profiles allow BIG-IP to process authorization and identity-related requests, while APM access policies evaluate those requests and determine the actions that follow.

    The flaw confirmed by F5 as exploited is a heap-based buffer overflow in the OAuth handling path of the Traffic Management Microkernel, the component that processes data plane traffic on BIG-IP. When a virtual server is configured with both an APM access policy and an OAuth profile, specially crafted requests corrupt memory during OAuth processing. That corruption leads to code execution on the appliance without an attacker requiring valid credentials.

    F5's advisory includes indicators associated with observed attacks, including repeated OAuth authentication failures, suspicious command activity, and subsequent Traffic Management Microkernel (TMM) crash events. F5 did not describe the exploitation process or explain how these events relate to each stage of exploitation. See the Indicators of Compromise section of this advisory for more information, or F5’s official advisory here.

    Although F5’s advisory states the issue was initially discovered internally, CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) Catalog on September 22, 2026, based on the reported evidence of active exploitation.

    How Beazley Security is responding

    Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

    We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

    If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

    Sources