CVE-2026-94127 Exploits F5 BIG-IP APM Heap Overflow for Unauthenticated RCE

Summary

A detailed analysis explains how an oversized Authorization header can overflow a heap buffer in F5 BIG-IP APM’s OAuth UserInfo handler, corrupt a callback, and enable unauthenticated remote code execution.

Key points

The flaw is an unauthenticated heap buffer overflow in BIG-IP APM’s OAuth UserInfo handler.
An attacker needs network access to a virtual server configured with an APM access policy and OAuth profile; no account or valid token is required.
The handler allocates 0x4100 bytes but copies the attacker-controlled Authorization header without enforcing that size limit.
The overflow can overwrite a nearby callback pointer, enabling a stack pivot and ROP chain.
The demonstrated chain modifies /etc/bigstart/scripts/tmm.finish so Bash runs an attacker-supplied command after TMM crashes.
The post describes a Picus Platform simulation for testing security controls; it provides no affected-version or patch-status details.

Article Details

Attack Vectors: An unauthenticated attacker with network access to an affected BIG-IP virtual server configured with an APM access policy and OAuth profile can send an oversized Authorization header to the OAuth UserInfo handler.
The oversized header overflows the handler's 0x4100-byte heap buffer, allowing corruption of a neighboring callback pointer. The described exploit uses a stack pivot and ROP chain to append a command to /etc/bigstart/scripts/tmm.finish, which Bash runs after TMM crashes.
Defensive Notes: The article recommends simulating CVE-2026-94127 attacks with the Picus Platform to test security controls.
The vulnerable handler is exposed through the OAuth UserInfo endpoint; the default path given is /f5-oauth2/v1/userinfo, though the OAuth profile setting can change it.