Critical F5 BIG-IP APM Zero-Day Exploited for Remote Code Execution

Threat actors are actively exploiting a critical zero-day F5 BIG-IP vulnerability to execute arbitrary code on exposed edge appliances. Tracked as CVE-2026-94127 with a CVSS score of 9.8, the flaw allows unauthenticated attackers to achieve remote code execution (RCE) on vulnerable F5 BIG-IP Access Policy Manager (APM) deployments. F5 discovered the vulnerability internally during security testing and confirmed active exploitation in the wild, prompting emergency hotfix releases and an immediate compliance deadline under Binding Operational Directive (BOD) 26-04 for federal agencies.

Understanding CVE-2026-94127 and Vulnerable Configurations

The vulnerability resides within the processing logic of BIG-IP APM when handling incoming OAuth authorization requests. Specifically, a deployment is vulnerable only when a virtual server is configured with both an APM access policy and an OAuth profile where BIG-IP APM is operating specifically as an OAuth Authorization Server. Deployments where APM acts solely as an OAuth Client or Resource Server are unaffected.

F5 confirmed that vulnerable versions include BIG-IP APM 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3. Devices running in Appliance mode are also susceptible. Crucially, no control plane exposure exists; this is strictly a data plane flaw. However, because virtual servers handling OAuth traffic are explicitly meant to face inbound network connections, data plane flaws of this nature bypass traditional administrative isolation controls that restrict management interface access.

Technical Mechanics and Data Plane Exposure

The attack vector operates over the data plane, meaning an unauthenticated attacker only needs network reachability to an exposed virtual server configured with the targeted profile combination. By sending specially crafted malicious network traffic directly to the virtual server processing OAuth requests, an attacker triggers a critical flaw in the APM data-plane processing engine.

Edge network appliances like load balancers and access gateways frequently handle parsing of complex protocols (such as OAuth 2.0 authorization flows) at high speeds. When input handling or memory management fails during token generation, validation, or access policy evaluation, attackers can manipulate the appliance’s state to achieve arbitrary code execution. Because the data plane processes live traffic from untrusted networks, management-plane mitigations—such as restricting access to the TMUI (Traffic Management User Interface) or SSH interfaces—offer no protection against this attack.

Realistic Blast Radius for Enterprise Environments

F5 BIG-IP APM serves as a foundational security gateway across enterprise, government, and critical infrastructure networks, handling identity federations, zero-trust network access (ZTNA), SSL VPN terminations, and single sign-on (SSO) infrastructure. Achieving unauthenticated remote code execution on an APM appliance presents a catastrophic scenario for affected organizations:

• Initial Access & Perimeter Bypass: An attacker gaining code execution on an APM instance secures a beachhead directly inside the network edge, entirely bypassing perimeter security controls and MFA protections.
• Credential & Session Hijacking: Because BIG-IP APM processes user credentials, session tokens, and OAuth grant keys in system memory, compromise allows threat actors to intercept ongoing user sessions and extract high-value domain credentials.
• Lateral Movement: Network appliances are frequently trusted to route traffic into isolated core segments, data centers, and cloud environments. Code execution on the appliance enables attackers to execute network discovery, pivot into internal subnets, and establish persistent command-and-control (C2) channels.
• EDR Blind Spots: Network security appliances run proprietary, hardened operating systems that rarely support standard Endpoint Detection and Response (EDR) agents, giving threat actors an unmonitored environment to maintain persistence.

Immediate Remediation and Detection Guidance

Organizations running BIG-IP APM must evaluate their exposure immediately. Remediation requires applying the hotfixes released by F5 for affected software versions:

• Update Target Versions: Upgrade vulnerable BIG-IP APM software (21.1.0, 17.5.0–17.5.1, 17.1.0–17.1.3) to the patched hotfix releases provided in F5’s security advisory.
• Configuration Verification: Inspect virtual server configurations to identify any instances combining an APM access policy and an OAuth profile set to the OAuth Authorization Server role. If OAuth Authorization Server functionality is not strictly required on an exposed virtual server, temporarily disabling the OAuth profile removes the exploit condition.
• Threat Hunting & Log Analysis: F5 published three distinct indicators of compromise (IoCs) associated with known exploitation attempts. System administrators should inspect /var/log/apm and system audit logs, searching for the combined and unusually frequent appearance of these IoCs to detect compromise attempts.
• Federal Directives: Federal civilian agencies governed by CISA directives must apply the hotfix or remove vulnerable configurations within three business days under BOD 26-04 mandates.