F5 has shipped emergency fixes for a critical, unauthenticated remote code execution flaw in BIG-IP Access Policy Manager (APM), and attackers got there first. CVE-2026-94127 (CVSS 9.8) is a heap-based buffer overflow (CWE-122) in APM’s OAuth profile handling, and it’s being actively exploited against internet-facing BIG-IP deployments. CISA added it to the Known Exploited Vulnerabilities catalog on September 22, with the Canadian Centre for Cyber Security independently corroborating in-the-wild activity.
What happened
The bug lives in how BIG-IP processes OAuth authentication requests when a virtual server is configured with both an APM access policy and an OAuth profile — a standard setup for organizations using BIG-IP as an SSO gateway or federated-identity front door for OAuth-based applications. The OAuth profile handling logic writes attacker-controlled data into a heap allocation without validating its size. The write overruns the buffer and corrupts adjacent heap memory inside the Traffic Management Microkernel (TMM), BIG-IP’s data-plane process. An attacker who can shape the contents of the corrupted region can influence TMM’s control flow, turning a memory-safety bug into arbitrary code execution.
The critical detail: this fires in the data plane, not the management plane. There’s no login page to brute-force and no admin credential to steal first — a crafted request to the exposed virtual server is enough. Any BIG-IP system where APM and an OAuth profile are attached to the same virtual server is exposed to the internet by design, since that’s the whole point of using it as an authentication gateway.
Affected versions and fix
F5 has published fixes and hotfixes covering supported BIG-IP branches; see F5’s advisory K000162605 for the exact build numbers for your version and module set. Two details matter more than the version table:
- Appliance-mode BIG-IP systems are also vulnerable — appliance mode is often assumed to reduce attack surface, and it does not help here.
- Versions that have reached End of Technical Support will not receive a patch. If you’re running an EoTS branch with this configuration, the only real mitigation is removing the OAuth profile from the affected virtual server or taking the device out of internet-facing service.
Organizations that can’t patch immediately should audit which virtual servers combine an APM access policy with an OAuth profile and restrict or disable that combination where it isn’t strictly required.
Impact
BIG-IP APM sits at the authentication chokepoint for a huge number of enterprise networks — it’s often the thing standing between the internet and VPN access, SSO, or internal application portals. Unauthenticated RCE on that device means an attacker can potentially pivot straight into whatever the appliance was gatekeeping, with no credentials needed. Given F5’s install base and the fact this is a network-facing zero-day already weaponized before most admins had patched, expect broad scanning and opportunistic exploitation to continue well past the initial wave CCCS and CISA flagged.
Mitigation — what to do now
- Patch immediately to the fixed version per F5 advisory K000162605, prioritizing any virtual server with APM + OAuth profile configured.
- Inventory exposure: identify every virtual server pairing an APM access policy with an OAuth profile, even on devices you don’t think of as internet-facing.
- If you can’t patch today, remove the OAuth profile from affected virtual servers or restrict access at the network layer until you can.
- Check for EoTS branches in your fleet — those need a compensating control or an upgrade plan, not a patch that doesn’t exist.
- Review logs for anomalous TMM crashes or restarts on APM-fronted virtual servers, which can indicate failed or successful exploitation attempts predating detection.