CVE-2026-94127: What F5 BIG-IP Operators Need to Know About the Exploited APM Flaw

F5 disclosed CVE-2026-94127 on September 22, 2026, and the advisory includes the phrase every operations team dreads: the vulnerability has been exploited. It is a heap-based buffer overflow in BIG-IP Access Policy Manager, rated 9.8 under CVSS v3.1, and it allows an unauthenticated remote attacker to execute code on the appliance. This article covers what the flaw is, which systems match the affected configuration, and what the fix requires.

The short version

CVE-2026-94127 affects BIG-IP APM. The vulnerable code runs in the Traffic Management Microkernel, the data plane process. The trigger is malicious traffic sent to a virtual server that has both an APM access policy and an OAuth profile configured. No credentials are needed. The result is remote code execution. F5 has released hotfixes and offers an emergency iRule for organizations that cannot upgrade immediately.

Technical detail

BIG-IP separates the control plane, which handles configuration, from the data plane, which handles client traffic. The Traffic Management Microkernel implements the data plane. F5 states that CVE-2026-94127 is a data plane issue with no control plane exposure, which places the vulnerable code on the traffic path rather than the management path.

The defect is a heap-based buffer overflow. The OAuth profile handling logic writes attacker-influenced data into a heap allocation without validating the size of the input. The write overruns the allocation and corrupts adjacent heap memory. An attacker who can influence the contents of the corrupted region can affect control flow inside TMM, which turns the memory corruption into arbitrary code execution.

Appliance mode does not help. That mode restricts administrative operations, not data plane traffic handling, so an appliance in Appliance mode remains vulnerable to this attack.

Which systems match the affected pattern

• APM provisioned on the BIG-IP system.
• A virtual server with an APM access policy attached.
• An OAuth profile configured on that virtual server.
• Network reachability to that virtual server.

This is the standard deployment pattern for BIG-IP APM used for single sign-on and OAuth-based access control. Organizations that deployed the product for its intended purpose frequently meet all four conditions.

Affected versions

• BIG-IP 21.1.0
• BIG-IP 17.5.0 through 17.5.1
• BIG-IP 17.1.0 through 17.1.3

F5 states that other BIG-IP modules and NGINX products are unaffected. Check the exact hotfix level against the advisory, because the branch number alone does not tell you whether the fix is installed.

Why the impact is broad

TMM handles traffic for the appliance's virtual servers. An attacker with code execution there can observe and modify traffic in transit, connect to internal services that trust the BIG-IP, and use the appliance as a base for further movement. Because TMM serves multiple virtual servers, one exploited appliance can expose every application routed through it.

For organizations that use a BIG-IP pair as their primary ingress, that is the entire external attack surface. The trust that internal services place in the gateway amplifies the impact.

Exposure context

A ZoomEye search for http.body="BIG-IP" && http.body="APM" returned 59,063 instances globally during this analysis. The query matches internet-visible assets whose HTTP responses contain both markers. It reflects the size of the BIG-IP APM deployment footprint, not the number of systems confirmed vulnerable. A matching asset may be patched, may not have an OAuth profile bound to an access policy, or may be protected by additional controls. A query for vul.cve="CVE-2026-94127" returned zero, which is expected for a CVE disclosed the same day and not yet indexed by identifier. Treat the count as deployment scale, not as a victim count.

Remediation

F5 published engineering hotfixes for the affected branches:

• Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
• Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
• Hotfix-BIGIP-17.1.3.5.0.41.14-ENG

If an immediate upgrade is not possible, request the emergency iRule from F5 Support. It is a temporary mitigation and should be removed after the hotfix is applied.

Additional measures while remediation is underway:

• Restrict which source networks can reach virtual servers that combine an APM access policy with an OAuth profile.
• Monitor OAuth authentication logs for repeated failures.
• Remove OAuth profiles from virtual servers that do not need them.
• Inspect previously exposed unpatched appliances for unauthorized configuration changes after upgrading.

References

• F5 security advisory for CVE-2026-94127
• SecurityOnline.info, "Exploited BIG-IP APM Vulnerability Allows Remote Code Execution," September 22, 2026: https://securityonline.info/big-ip-apm-vulnerability-cve-2026-94127/