CVE-2026-94127: 
F5 BIG-IP Virtual Edition (tier - best) vulnerability analysis and mitigation

CVE-2026-94127 is a heap-based buffer overflow (CWE-122) in F5 BIG-IP Access Policy Manager (APM) that enables unauthenticated remote code execution (RCE) when an APM access policy and OAuth profile are configured on a virtual server. The vulnerability was disclosed on September 22, 2026, and affects BIG-IP APM versions 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0. Systems configured solely as an OAuth Client or Resource Server (without an OAuth Authorization Server profile) are not affected. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (F5 Advisory, GitHub Advisory).

The root cause is a heap-based buffer overflow (CWE-122) in the BIG-IP APM component responsible for processing OAuth Authorization Server traffic. When a virtual server is configured with both an APM access policy and an OAuth profile, specially crafted malicious network traffic can trigger an out-of-bounds write on the heap, leading to arbitrary code execution. The vulnerability exists entirely in the data plane — there is no control plane exposure, and exploitation does not require authentication, user interaction, or elevated privileges. A technical deep-dive published by watchTowr Labs (titled "Is this a joke in the auth header?") details the pre-authentication heap overflow path and confirms the vulnerability is reachable via crafted HTTP requests to the OAuth authorization endpoint (watchTowr Labs, F5 Advisory).

Successful exploitation grants an unauthenticated remote attacker full code execution on the BIG-IP system, resulting in complete compromise of confidentiality, integrity, and availability. Because BIG-IP APM acts as a network access gateway and identity broker, a compromised appliance could expose VPN credentials, session tokens, and downstream application access, enabling significant lateral movement into protected enterprise environments. The vulnerability also affects BIG-IP systems running in Appliance mode, and approximately 14,700 internet-exposed IPs were reported as potentially vulnerable at the time of disclosure (F5 Advisory, DeafNews).

CVE-2026-94127 was exploited as a zero-day in the wild prior to F5's patch release and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on September 22, 2026, with a three-day remediation deadline for federal agencies (CISA KEV). A public PoC scanner (detection-only, not a weaponized exploit) was published on GitHub by FurkanKAYAPINAR on September 23, 2026, and watchTowr Labs released a full pre-authentication RCE PoC repository shortly after (watchTowr Labs, GitHub PoC). The EPSS score is approximately 2.23% (82nd percentile), and NVD's SSVC assessment classifies exploitation as "active" and the attack as "automatable" with "total" technical impact (GitHub Advisory). No specific threat actor attribution has been publicly confirmed.

1. Reconnaissance: Use Shodan, Censys, or similar tools to identify internet-facing F5 BIG-IP APM instances running affected versions (17.1.0–17.1.3, 17.5.0–17.5.1, or 21.1.0). Confirm the target is configured as an OAuth Authorization Server by probing OAuth-related endpoints (e.g., /oauth/authorize, /oauth/token).
2. Fingerprint the target: Send standard HTTP requests to the virtual server's OAuth endpoints to confirm the presence of an APM access policy and OAuth profile, which is the prerequisite for exploitation.
3. Craft malicious OAuth request: Construct a specially crafted HTTP request targeting the OAuth Authorization Server processing path. The payload is designed to trigger a heap-based buffer overflow in the APM component by supplying malformed or oversized data in a specific OAuth request field (e.g., a crafted Authorization header or OAuth parameter), as detailed in the watchTowr Labs write-up.
4. Trigger heap overflow: Send the crafted request to the vulnerable virtual server. The malformed input overflows a heap buffer in the APM OAuth processing code, corrupting adjacent heap metadata or function pointers.
5. Achieve code execution: The heap corruption is leveraged to redirect execution flow, achieving arbitrary code execution as the process user on the BIG-IP data plane. This may involve bypassing SELinux protections (researchers noted intentional process crashes were used to bypass SELinux on BIG-IP).
6. Post-exploitation: With RCE established, the attacker can deploy a reverse shell, exfiltrate VPN session tokens or credentials, pivot to internal network resources accessible through the BIG-IP gateway, or establish persistence (watchTowr Labs, Rapid7 ETR).

• Network: Anomalous or malformed HTTP requests to OAuth Authorization Server endpoints (e.g., /oauth/authorize, /oauth/token) on BIG-IP virtual servers, particularly with oversized or unexpected header values; unexpected outbound connections from the BIG-IP data plane to external IPs.
• Logs: BIG-IP APM access logs showing repeated or unusual requests to OAuth endpoints from single or rotating source IPs; process crash logs or core dump files generated by the APM daemon (researchers noted deliberate crashes were used to bypass SELinux); unexpected errors in /var/log/apm or /var/log/ltm related to OAuth processing.
• File System: Unexpected files written to the BIG-IP filesystem, particularly in /tmp, /var/tmp, or web-accessible directories; new or modified scripts, cron jobs, or startup entries created by the APM process user.
• Process: Unusual child processes spawned by the BIG-IP APM daemon (e.g., shell interpreters, curl, wget, python); unexpected network connections initiated by APM worker processes.
• Scanning Activity: Inbound probes to OAuth endpoints from scanning infrastructure (detectable via the defensive scanner at GitHub PoC Scanner) (watchTowr Labs, Rapid7 ETR).

F5 has released hotfix patches for all affected branches: Hotfix-BIGIP-17.1.3.5.0.41.14-ENG (for 17.1.x), Hotfix-BIGIP-17.5.1.9.0.160.12-ENG (for 17.5.x), and Hotfix-BIGIP-21.1.0.2.0.30.22-ENG (for 21.1.0). Organizations should apply the appropriate hotfix immediately via the F5 support portal. As an interim workaround where patching is not immediately possible, restrict access to the BIG-IP virtual server's OAuth Authorization Server endpoints using IP allowlisting or firewall rules, and consider disabling the OAuth Authorization Server profile if it is not operationally required. CISA mandated remediation for federal agencies within three days of the September 22, 2026 KEV listing (F5 Advisory, CISA KEV).

F5 published an official security advisory (K000162605) on September 22, 2026, confirming active exploitation and providing hotfix details (F5 Advisory). CISA added the vulnerability to its KEV catalog the same day and issued an emergency directive requiring federal agencies to patch within three days (CISA KEV). watchTowr Labs published a widely circulated technical write-up titled "Is this a joke in the auth header?" along with a full PoC, which generated significant discussion across Reddit (r/netsec, r/blueteamsec, r/cybersecurity), Mastodon, and Bluesky (watchTowr Labs). Multiple national CERTs — including Canada (CCCS), Belgium (CCB), Ireland (NCSC-IE), Hong Kong (HKCERT/GovCERT), and CERT-EU — issued independent advisories urging immediate patching (Canadian Advisory, CERT-EU). Security vendors including Rapid7, eSentire, SOCRadar, Picus Security, and Beazley Security all published threat intelligence reports highlighting the critical risk to organizations running BIG-IP APM as an OAuth Authorization Server (Rapid7 ETR, eSentire Advisory).