F5 BIG-IP APM zero-day puts OAuth access edge on patch-now list
BleepingComputer
news
F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks
The Hacker News
news
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers
The Register
news
Someone's attacking a critical 0-day RCE in F5 BIG-IP APM
Active exploitation
CVE-2026-94127 was exploited as a zero-day before fixes were available.
OAuth condition
The reported vulnerable pattern requires BIG-IP APM acting as an OAuth Authorization Server with an access policy and OAuth profile on a virtual server.
RCE impact
Successful exploitation can allow unauthenticated remote code execution on affected deployments.
F5 has patched CVE-2026-94127, a critical BIG-IP Access Policy Manager vulnerability exploited as a zero-day in remote code execution attacks against specific OAuth Authorization Server deployments. The affected pattern is narrower than “all APM,” but it sits in a high-value position: an access proxy and identity-adjacent service that often fronts enterprise applications, APIs, cloud services, VPN flows and single sign-on paths.13
The vulnerable configuration is a BIG-IP APM virtual server with both an APM access policy and an OAuth profile, where APM serves as an OAuth Authorization Server. F5 and multiple advisories distinguish that role from APM deployments used only as an OAuth client or resource server, which are not affected under the reported condition.125
Security teams should treat the issue as operationally urgent. The flaw is described as a heap-based buffer overflow with unauthenticated remote code execution impact, rated critical, and confirmed as actively exploited in the wild.2368 CISA also added the vulnerability to its Known Exploited Vulnerabilities catalog, reinforcing that this is not a routine maintenance item for exposed access infrastructure.14
The core exposure condition is configuration-based. According to reporting on F5 guidance, a BIG-IP APM system becomes vulnerable when APM is configured as an OAuth Authorization Server and the relevant access policy and OAuth authorization server profile are attached to the same virtual server that receives OAuth traffic.2 CERT-SE described the same practical condition as a product configured with an access policy and OAuth profile on a virtual server.8
Reported vulnerable branches include BIG-IP APM 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3, with engineering hotfixes available for supported branches.26 CERT-FR listed the corresponding hotfix identifiers as Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso, and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG.iso.7
Operators should not assume that restricting the BIG-IP management interface is enough. The Hacker News reported that malicious traffic reaches the affected virtual server itself, while SecurityWeek noted that the issue is on the data plane, not the control plane.25 In practical terms, a locked-down admin interface does not remove risk if the vulnerable OAuth-facing virtual server remains reachable.
BIG-IP APM is not just another application component. It is commonly deployed as centralized access-management infrastructure: a policy enforcement point that brokers access to internal applications, cloud resources, APIs, network services and remote-user workflows.13 That placement makes configuration flaws in APM more sensitive than vulnerabilities in isolated line-of-business systems.
OAuth Authorization Server functionality is especially important because it participates in token issuance and access decisions. Even when exploitation does not directly mean theft of all tokens or compromise of every downstream application, remote code execution on the access edge can give attackers a powerful foothold near authentication flows, session handling, user routing, application gateways and internal service paths.
That is the broader lesson from CVE-2026-94127: identity and access infrastructure increasingly is the exposed application edge. The same systems that make SSO, conditional access, VPN, federation and API access more manageable also concentrate operational risk. When one of those systems is internet-facing, security teams need to assess it with the same urgency they would apply to a perimeter VPN, reverse proxy or externally exposed application gateway.4
First, inventory BIG-IP APM systems and identify any virtual servers with APM access policies and OAuth profiles attached. Pay special attention to configurations where APM is acting as an OAuth Authorization Server, not merely as an OAuth client or resource server.12
Second, confirm branch and build status. Systems on the affected supported branches should receive the applicable engineering hotfix. CSO Online and CERT-FR both reported hotfix availability across the 21.1, 17.5 and 17.1 branches. Organizations should verify exact filenames, branch applicability and installation prerequisites through F5 support channels before deployment.47
Third, if the hotfix cannot be applied immediately, deploy the vendor-provided iRule mitigation to affected virtual servers. BleepingComputer and CSO Online reported that F5 made an iRule available through F5 Support for interim mitigation, but this should be treated as a bridge to patching rather than a permanent fix.14
Fourth, review for signs of compromise before and after remediation. F5 guidance cited by BleepingComputer and CSO Online points operators toward correlated evidence: repeated OAuth authentication failures, suspicious commands, and a TMM SIGABRT or related crash behavior close in time.14 CSO Online also reported that administrators can check OAuth failure counts and review audit logs and TMM core files around suspicious timestamps.4
Finally, document whether exposed systems are patched, mitigated or confirmed not affected by role and configuration. Shadowserver exposure data cited by BleepingComputer and CSO Online showed more than 14,700 to more than 15,000 BIG-IP APM fingerprints or deployments visible online, underscoring why external exposure validation matters even when the vulnerable subset is configuration-specific.14
CVE-2026-94127 is a configuration-specific flaw, but not a low-priority one. The vulnerable deployment pattern sits at the intersection of access policy, OAuth, virtual-server exposure and enterprise edge routing. For security operations teams, the immediate job is to identify OAuth Authorization Server configurations, patch or mitigate them, preserve and review evidence of possible exploitation, and avoid assuming that management-plane hardening protects a vulnerable data-plane service.568
OpenAI’s ChatGPT Ads app for Shopify expanded internationally on September 23 in supported markets, bringing catalog sync, Shopify-based campaign launch and commerce-event measurement into the ad setup. The rollout comes as Sponsored Agents test a more explicit boundary between ordinary ChatGPT answers and paid, brand-run conversations.
Microsoft launched a public preview of Integrated Security Operations Center in Microsoft Defender on September 23, bringing SIEM, XDR, automation, case management and agent workflows into one Defender experience. For enterprise SOCs, the immediate question is not whether agents can be added, but whether teams can prove automated workflows are governed, observable and safe enough to trust.
Qualcomm is positioning Snapdragon X2 PCs as a platform for agentic AI that can run locally, span phones and laptops, and expand beyond Windows into Googlebook and Linux systems. The engineering case is credible but incomplete: NPUs, Ubuntu support and device continuity reduce friction, while model limits, software integration and cloud handoffs remain decisive.
At Connect 2026, Meta split its glasses strategy across audio-only AI, camera-equipped capture glasses, display glasses and 100-gram VR glasses. The result is a clearer product ladder, but also a sharper set of tradeoffs around cameras, displays, immersion and privacy.
BIG-IP APM
F5’s Access Policy Manager module, used to enforce access policies and broker access to applications, networks, cloud services and APIs.
OAuth Authorization Server
The OAuth role that issues tokens used by clients and applications to access protected resources.
Virtual server
In BIG-IP terminology, a listener and policy attachment point that receives client traffic and applies configured profiles and access logic.
iRule
An F5 traffic-handling script that can be applied to BIG-IP virtual servers; in this case, F5 provided one as an interim mitigation path.
Comments