CVE-2026-94127: 
F5 BIG-IP Virtual Edition (tier - best) 脆弱性の分析と軽減

CVE-2026-94127 is a heap-based buffer overflow vulnerability in F5 BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution when the system is configured as an OAuth Authorization Server. The vulnerability was published on September 22, 2026, and affects BIG-IP APM versions 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0. Deployments using APM strictly as an OAuth Client or Resource Server (without OAuth Authorization Server profiles) are not affected. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, F5 Advisory).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), triggered when specific malicious traffic is processed by the BIG-IP APM OAuth Authorization Server component configured on a virtual server. An unauthenticated attacker can send crafted network requests that overflow a heap buffer in the OAuth profile processing logic, ultimately achieving arbitrary code execution on the data plane. The vulnerability requires no privileges, no user interaction, and has low attack complexity, making it trivially automatable. A technical write-up by watchTowr Labs titled "Is This a Joke in the Auth Header?" provides detailed exploitation mechanics (watchTowr Labs, Rapid7 ETR).

Successful exploitation grants an unauthenticated attacker full remote code execution on the affected BIG-IP system, resulting in complete compromise of confidentiality, integrity, and availability. Because BIG-IP APM acts as a network access gateway and identity broker, a compromised appliance could expose authenticated user sessions, VPN credentials, and downstream internal network resources, enabling significant lateral movement. The BIG-IP system in Appliance mode is also vulnerable, and the issue is confined to the data plane with no control plane exposure. Approximately 14,700 internet-exposed IPs were reported as potentially vulnerable at the time of disclosure (deafnews.it, F5 Advisory).

CVE-2026-94127 was exploited as a zero-day in the wild prior to F5's patch release and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on September 22, 2026, with CISA ordering emergency patching (CISA KEV). The vulnerability is rated as automatable by NVD SSVC with total technical impact. A defensive scanner (not a weaponized exploit) was published on GitHub by FurkanKAYAPINAR for detection purposes; no confirmed weaponized public exploit code has been identified as of the report date (GitHub PoC). The EPSS score is approximately 1.39% (71st percentile), and active exploitation has been reported by multiple national CERTs including Canada's CCCS, Belgium's CCB, and Ireland's NCSC (Canadian CCCS, Belgium CCB).

1. Reconnaissance: Use Shodan, Censys, or Fofa to identify internet-facing F5 BIG-IP APM instances running affected versions (17.1.0–17.1.3, 17.5.0–17.5.1, or 21.1.0) with OAuth Authorization Server profiles configured on virtual servers.
2. Fingerprint target: Confirm the target is configured as an OAuth Authorization Server by probing OAuth-related endpoints (e.g., /oauth/token, /oauth/authorize) and inspecting HTTP response headers or error messages that reveal BIG-IP APM identity.
3. Craft malicious OAuth request: Construct a specially crafted HTTP request targeting the OAuth Authorization Server endpoint with a malformed or oversized value in the Authorization header or OAuth parameter field designed to trigger the heap buffer overflow in the APM OAuth processing component.
4. Trigger heap overflow: Send the crafted request to the virtual server. The malicious input overflows a heap-allocated buffer in the OAuth profile handler, corrupting adjacent heap metadata or function pointers.
5. Achieve code execution: The heap corruption is leveraged to redirect execution flow, resulting in arbitrary code execution as the BIG-IP data plane process (typically running with elevated privileges), enabling reverse shell establishment, credential harvesting, or further network pivoting (watchTowr Labs, Rapid7 ETR).

• Network: Anomalous or malformed HTTP requests to OAuth Authorization Server endpoints (e.g., /oauth/token, /oauth/authorize) with oversized or binary-encoded Authorization headers; unexpected outbound connections from the BIG-IP data plane to external IPs.
• Logs: BIG-IP APM access logs showing repeated requests to OAuth endpoints from single or rotating source IPs with unusual payload sizes or encoding; crash/core dump entries in /var/log/ltm or /var/log/apm related to the OAuth profile handler process.
• Process: Unexpected child processes spawned by the BIG-IP APM daemon (e.g., shell interpreters, curl, wget, python); unusual process activity under the tmm (Traffic Management Microkernel) process.
• File System: New or modified files in /tmp, /var/tmp, or BIG-IP configuration directories; presence of web shells or unauthorized scripts; unexpected cron jobs or scheduled tasks added post-exploitation.
• Qualys Detection: Qualys QID 388803 can be used to detect vulnerable BIG-IP APM instances (GitHub Advisory, SOC Prime).

F5 has released hotfix patches for all affected versions: Hotfix-BIGIP-17.1.3.5.0.41.14-ENG (for 17.1.0–17.1.3), Hotfix-BIGIP-17.5.1.9.0.160.12-ENG (for 17.5.0–17.5.1), and Hotfix-BIGIP-21.1.0.2.0.30.22-ENG (for 21.1.0), available via the F5 support portal (F5 Advisory). Organizations unable to patch immediately should consider removing OAuth Authorization Server profiles from virtual servers if not operationally required, and implement network segmentation to restrict access to BIG-IP data plane interfaces from untrusted sources. CISA has mandated federal agencies apply patches under emergency directive; all organizations should treat this as a critical priority given active exploitation (CISA KEV).

F5 disclosed the vulnerability on September 22, 2026, confirming active exploitation in the wild and releasing hotfixes the same day (F5 Advisory). CISA added CVE-2026-94127 to its KEV catalog on September 22, 2026, alongside three other vulnerabilities, calling it the critical priority among the four (CISA KEV). watchTowr Labs published a detailed technical blog titled "Is This a Joke in the Auth Header?" that garnered significant community attention on Reddit (r/netsec, r/blueteamsec, r/cybersecurity) and Mastodon, with researchers highlighting the irony of an auth header flaw in an access management product (watchTowr Labs). Coverage appeared in BleepingComputer, SecurityWeek, The Hacker News, The Register, Heise, Help Net Security, and CSO Online, with multiple national CERTs (Canada, Belgium, Ireland, Hong Kong, EU CERT) issuing independent advisories (BleepingComputer, SecurityWeek).