Heap-based buffer overflow in F5 BIG-IP APM
A heap-based buffer overflow (CWE-122) in the F5 BIG-IP Access Policy Manager (APM) allows for unauthenticated remote code execution directly on the Traffic Management Microkernel (TMM) data plane. Tracked as CVE-2026-94127, the vulnerability carries a CVSS score of 9.8. The flaw triggers only under one specific configuration: a virtual server must be simultaneously configured with both an APM access policy and an OAuth profile. Because the overflow occurs in the data plane rather than the control plane, the management interface is not the primary vector, and the attack is network-accessible without authentication.
F5 confirmed the vulnerability in advisory K000162872 on September 2, 2026, noting it was discovered internally. Active exploitation is currently underway, corroborated by the Canadian Centre for Cyber Security. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 22, 2026. Under the federal binding operational directive BOD 26-04, agencies are required to remediate within three calendar days, establishing a hard deadline of September 25, 2026. This timeline reflects the high-risk classification: the vulnerability is considered automatable and capable of total technical impact.
Operational risk and the September cluster
The technical mechanics of CVE-2026-94127 highlight the fragility of multi-functional security appliances. When complex features like OAuth and APM intersect on a single virtual server, the memory allocation logic in the TMM data plane fails. This is not a global vulnerability across all F5 deployments, but it is a critical failure point for any organization utilizing this specific configuration. The risk is compounded by the fact that appliance-mode BIG-IP systems are also vulnerable, and versions that have reached their End of Technical Support will not receive patches.
This incident joins a September cluster of high-impact security events that have tested the resilience of trust-based systems. The BlueMoon Patch-Gap demonstrated the dangers of delayed remediation, while the ADSys Trust-Store issues showed how deeply embedded authentication mechanisms can be weaponized. Similar to the SharePoint RCE and the Linux Kernel flaws, CVE-2026-94127 targets the core engines of network traffic processing. These events, alongside Cisco ISE and the Meta Muse macOS 0-Day, form a pattern where attackers are systematically probing the trust infrastructure layer to bypass perimeter defenses.
Remediation and identification
Organizations must immediately inventory all virtual servers to identify the pairing of an APM access policy and an OAuth profile. F5 has released engineering hotfixes for three affected version trains: BIG-IP 21.1.0 (Hotfix-BIGIP-21.1.0.2.0.30.22-ENG), 17.5.x (Hotfix-BIGIP-17.5.1.9.0.160.12-ENG), and 17.1.x (Hotfix-BIGIP-17.1.3.5.0.41.14-ENG). For environments where immediate patching is not feasible, an iRule mitigation is available to protect virtual servers configured with the vulnerable pairing.
Security teams should monitor for specific indicators of compromise:
- Repeated OAuth authentication failures
- Execution of suspicious commands on the device
- TMM SIGABRT crashes
Given the active exploitation and the federal mandate, this should be treated as a high-priority patching event. Organizations operating on legacy versions that have reached their End of Technical Support must assume they are unprotected, as no hotfixes will be provided for those systems.