F5 BIG-IP APM Critical Heap Overflow (CVE-2026-94127) Allows Unauthenticated RCE

A critical F5 BIG-IP APM vulnerability tracked as CVE-2026-94127 allows unauthenticated network attackers to achieve remote code execution on exposed edge devices. The flaw is a heap-based buffer overflow that manifests when an Access Policy Manager (APM) virtual server is configured with both an active access policy and an OAuth profile. Because the flaw can be triggered remotely without credentials or user interaction, it carries a maximum CVSS v3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Answering the OAuth Parsing Flaw

The vulnerability resides in the memory management handling within BIG-IP APM’s underlying traffic processing routines. When a virtual server processes inbound OAuth authentication requests, malformed or oversized payload fields—such as crafted bearer tokens, authorization headers, or state parameters—exceed allocated heap memory boundaries (CWE-122).

Because APM handles identity verification at the network boundary, this memory corruption occurs prior to session establishment. An attacker crafting a tailored sequence of HTTP requests can corrupt adjacent heap structures, leading to a denial-of-service crash of the Traffic Management Microkernel (TMM) or full system-level arbitrary code execution. Given the low attack complexity and absence of prerequisites beyond reaching the virtual server port, automated exploitation is highly feasible.

Threat Landscape and Exposure Profile

Network perimeter devices, particularly SSL VPNs and identity gateways like BIG-IP APM, represent the highest-value targets for both advanced persistent threat (APT) groups and ransomware access brokers. Compromising an APM device grants an attacker an immediate, unmonitored foothold inside the target enterprise, bypassing multi-factor authentication (MFA) enforcement and allowing passive interception of active user sessions and credentials.

Organizations at highest risk include enterprises, financial institutions, and government entities utilizing BIG-IP APM as a single sign-on (SSO) gateway or OAuth authorization server for internal and cloud services. Any virtual server exposed directly to the public internet that terminates access policies with OAuth enabled should be treated as immediately vulnerable to internet-wide scanning and exploitation attempts.

Targeted Mitigation and Action Plan

To secure affected systems against CVE-2026-94127, administrators should execute the following steps immediately:

• Apply System Updates: Install the official F5 hotfix or engineering build for your specific BIG-IP APM release branch without delay.
• Identify Vulnerable Configurations: Query your BIG-IP configuration for virtual servers with both an access policy and an OAuth profile attached: tmsh list ltm virtual one-line | grep 'profiles' | grep -i 'oauth'
• Temporary Workaround: If patching cannot be performed immediately, temporarily unbind the OAuth profile from affected virtual servers or disable the vulnerable access policy paths. Alternatively, enforce strict IP access control lists (ACLs) upstream of the virtual server to limit reachability to trusted client networks.
• Triage and Forensics: Review TMM log files (/var/log/tmm*) and system messages (/var/log/messages) for unexpected core dumps, process restarts, or memory allocation errors occurring around OAuth endpoints. Federal entities operating under CISA BOD 26-04 must complete remediation or enforcement of mitigation controls by September 25, 2026.