Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.
NVD: When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).
Impact:
This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Hunt /var/log/apm for repeated OAuth UserInfo failures (err tmm: 01990004:3: invalid_token) with >=10 entries from one IP. Correlate tmctl global_oauth_stat total_failed spikes and TMM SIGABRT core files for exploit confirmation.
Research details
ComponentAPM OAuth profile processing in TMM (Traffic Management Microkernel) data plane
PreconditionsVirtual server must be configured with both a BIG-IP APM access policy and an OAuth profile; the attacker needs direct network reachability to the affected virtual server interface (AV:N); no authentication is required to trigger the heap overflow; vulnerable versions include BIG-IP APM 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3, all prior to their respective engineering hotfixes. agent
DeliverySpecially crafted OAuth protocol traffic sent to an exposed BIG-IP APM virtual server configured with an access policy and OAuth profile
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Actively exploited in the wild per F5. Heap overflow in TMM during OAuth UserInfo request handling allows unauthenticated RCE. An iRule mitigation is available from F5 Support as a temporary measure. No public proof-of-concept exploit code has been disclosed as of publication date.
SummaryCVE-2026-94127 is a critical heap-based buffer overflow (CWE-122, CVSS 9.8) in F5 BIG-IP APM OAuth profile processing within the TMM data plane. When a virtual server has both an APM access policy and an OAuth profile, specially crafted unauthenticated traffic corrupts heap memory and achieves remote code execution. F5 confirmed active exploitation in the wild and published engineering hotfixes for affected branches, with an iRule available as temporary mitigation.
Tia coverage
First reported2026-09-09
First exploit report2026-09-23
Exploit report → KEV1 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.