Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says.
The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes.
APM is the BIG-IP module that controls how users reach an organization’s applications and networks. The vulnerable setup has an APM access policy and an OAuth authorization server profile on the same virtual server, which hosts the BIG-IP address that receives the OAuth traffic. Specific malicious traffic sent to that virtual server can lead to remote code execution.
The flaw is a heap-based buffer overflow. F5 rates it 9.8 out of 10 on CVSS v3.1 and 9.3 on CVSS v4.0.
Because the malicious traffic goes to the virtual server itself, limiting access to the BIG-IP management interface does not protect against this flaw. BIG-IP systems in Appliance mode are also vulnerable.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on September 22. It gave federal civilian agencies until September 25 to apply F5’s mitigations, under a directive CISA issued in June.
F5’s CVE record and CISA’s KEV entry do not say how many systems were attacked, who the attackers are, or which organizations were targeted.
Who Is Affected
For systems where APM acts as an OAuth authorization server, these are the affected versions and the hotfix for each:
| Branch | Affected versions | Fixed in |
|---|---|---|
| 21.1 | 21.1.0, before the hotfix |
Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
|
| 17.5 | 17.5.0 to 17.5.1, before the hotfix |
Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
|
| 17.1 | 17.1.0 to 17.1.3, before the hotfix |
Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
|
Systems that use APM only as an OAuth client or resource server, with no OAuth authorization server profiles, are not affected.
F5 updated its CVE record at 00:45 UTC on September 23 to say the flaw is present only in the authorization server role. CISA’s KEV entry and an advisory from CERT-EU, the cybersecurity service for EU institutions, were published before that change. Both describe the condition more broadly, as an access policy and an OAuth profile on a virtual server.
In F5’s configuration guide for APM 17.1, 17.5 and 21.0, the authorization server’s OAuth profile is created under Access > Federation > OAuth Authorization Server > OAuth Profile. It is then selected in an access profile attached to the virtual server. A virtual server set up this way matches the condition F5 describes.
F5 did not evaluate versions that have reached End of Technical Support, so their status is unknown rather than safe.
Another APM flaw, CVE-2025-53521, was added to CISA’s KEV catalog in March. Its fixes for the 17.1 and 17.5 branches, 17.1.3 and 17.5.1.3, fall inside the affected ranges above. A system updated to either build still needs the new hotfix if APM acts as an OAuth authorization server on it.
What to Do Now
F5’s fix is the engineering hotfix listed for each branch in the table. When the hotfix cannot be installed immediately, F5 offers an iRule mitigation for the affected virtual server. Customers get it by opening a ticket with F5 support.
CERT-EU advises preserving forensic evidence first, applying the hotfix, checking for signs of compromise, and starting incident response if any are found.
CISA told agencies to apply the iRule first “to allow for proactive forensic triage,” and then to “install the final vendor patch as soon as possible.”
Checking for Compromise
The signs below are F5’s, as listed in CERT-EU’s advisory. The combination that should lead to a human review of the system is repeated OAuth authentication failures, followed by suspicious commands, followed by a TMM SIGABRT shortly after.
- APM log: repeated failed UserInfo requests in /var/log/apm with the error description “The access token is invalid.” Look especially for 10 or more requests from a single IP address within a short time.
- OAuth counter: an unexplained rise in total_failed when running tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed.
- Audit log: suspicious commands in /var/log/audit around the times of those failures.
- TMM core files: not a sign on their own, but worth investigating. F5 has seen TMM enter a loop, causing the SOD daemon to send a SIGABRT.
F5’s CVE record and the CISA and CERT-EU advisories do not say whether installing the hotfix removes access that an attacker already has.
