By F5 disclosed CVE-2026-94127 on September 22 — a heap-based buffer overflow in BIG-IP Access Policy Manager that hands an unauthenticated attacker code execution on any BIG-IP acting as an OAuth authorization server. CISA added it to its Known Exploited Vulnerabilities catalog the same day, which means exploitation was already happening when the advisory went public. Hotfixes are available. If you can’t patch immediately, F5 has an iRule workaround. Either way, you need to act before Friday.
Are You in Scope?
The flaw only triggers under one specific configuration: a virtual server running both an APM access policy and an OAuth authorization server profile simultaneously. That’s a common enterprise setup — organizations that use BIG-IP to issue OAuth tokens for internal APIs.
If you use BIG-IP as an OAuth client or resource server, you’re not affected. Only the authorization server role is vulnerable. To enumerate your virtual servers and check their profiles:
tmsh list ltm virtualFor each entry, verify whether it has both an APM access profile and an OAuth authorization server profile attached. If yes, that virtual server is in scope. Affected versions are 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0.
Patch or Mitigate
F5 has released engineering hotfixes for all affected branches. Apply the one that matches your installed version:
- 21.x: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso
- 17.5.x: Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso
- 17.1.x: Hotfix-BIGIP-17.1.3.5.0.41.14-ENG.iso
If patching requires a maintenance window you can’t reach before Friday, F5 provides an iRule workaround through its support portal. The iRule filters malicious OAuth traffic before it reaches the vulnerable code path — it’s a temporary measure, not a fix. Contact F5 Support to obtain it and deploy it on each affected virtual server.
Use the official F5 advisory K000162605 as your canonical reference. It will be updated as new versions and clarifications become available.
Why This Is Worse Than “Load Balancer RCE”
The vulnerability lands in the Traffic Management Microkernel — the process that handles all traffic passing through the device. That alone is serious. But the more important consequence is what a compromised authorization server means for everything downstream.
An OAuth authorization server issues access tokens. Compromise it and you can forge tokens for any user, any service, and any scope in your OAuth ecosystem. Attackers don’t need to brute-force internal APIs or exfiltrate credentials — they sign in with tokens your own infrastructure considers legitimate. That’s persistent, hard-to-detect access that doesn’t look like an intrusion until something breaks badly enough to get noticed.
This is why CISA’s same-day KEV listing matters. The catalog only receives additions when confirmed exploitation is documented — meaning attackers were working this flaw before F5 published the advisory. You’re not getting ahead of this; you’re catching up.
Check for Signs of Compromise
Before or after patching, review these logs on any in-scope BIG-IP:
- /var/log/apm: Ten or more
invalid_tokenOAuth failures from the same source IP in a short window - /var/log/ltm and /var/core/: TMM SIGABRT (signal 6) crash events following an OAuth failure cluster
- Unexpected command execution shortly after either pattern above
Each indicator is normal in isolation — OAuth failures and TMM restarts happen for legitimate reasons. The red flag is the temporal cluster: failures, then a crash, then something executing. If you see that pattern, treat the device as compromised and engage incident response before restarting services.
F5 BIG-IP has a track record of critical CVEs that get exploited hard and fast. CVE-2022-1388 and CVE-2021-22986 both hit CVSS 9.8 and saw mass exploitation within days of disclosure. The organizations hit worst assumed their maintenance window could wait a week. It couldn’t then, and it can’t now. Apply the hotfix, deploy the iRule if needed, and read Rapid7’s technical analysis if you need deeper exploit mechanics.
