F5 Releases Hotfixes for Actively Exploited BIG-IP APM RCE Flaw
Summary
F5 reports active exploitation of CVE-2026-94127, a heap-based buffer overflow enabling unauthenticated RCE on specifically configured BIG-IP APM virtual servers. Hotfixes are available; F5 also provides an iRule mitigation.
Key points
- The flaw affects virtual servers configured with both an APM access policy and an OAuth profile.
- Crafted OAuth-related traffic can trigger memory corruption and unauthenticated remote code execution; no user interaction is required.
- F5 says the vulnerability is being exploited in the wild and rates it CVSS 3.1 9.8.
- Affected branches include BIG-IP APM 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3; F5 released branch-specific engineering hotfixes.
- F5's indicators include repeated OAuth authentication failures, suspicious command activity, and TMM crash events.
- Review affected configurations, apply the applicable hotfix, or use F5's iRule mitigation while patching; investigate systems if compromise evidence is found.
Article Details
- Vulnerability Types
- Heap-based buffer overflow
- Severity
- CVSS v3.1: 9.8
- Affected Versions
- BIG-IP APM 21.1.0
- BIG-IP APM 17.5.0 through 17.5.1
- BIG-IP APM 17.1.0 through 17.1.3
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Apply F5's iRule mitigation, available through F5 Support, if the engineering hotfix cannot be deployed immediately.