CVE-2026-94127, F5 BIG-IP APM: unauthenticated heap overflow in OAuth-profile processing reaches RCE on the TMM data plane (CVSS 9.8)
F5 confirms exploitation of an unauthenticated RCE in BIG-IP's OAuth authentication gateway
Defender actions
- Inventory every BIG-IP APM virtual server pairing an access policy with an OAuth profile, and patch or apply the emergency iRule to each one now.
Analysis
CVE-2026-94127 (CVSS 3.1: 9.8, CVSS 4.0: 9.3, CWE-122 heap-based buffer overflow) is a vulnerability in F5 BIG-IP Access Policy Manager (APM) reachable on the Traffic Management Microkernel (TMM) data plane; F5 states "this is a data plane issue; there is no control plane exposure" (F5, via SecurityOnline, 2026-09-22). It triggers only on a virtual server configured with both an APM access policy and an OAuth profile. "When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE)" (F5, via SecurityOnline / Daily CyberSecurity, 2026-09-22): the OAuth-profile request-handling logic writes attacker-influenced data into a heap allocation without validating its size, corrupting adjacent heap memory and ultimately hijacking control flow inside TMM, exploitable by an unauthenticated, network-only attacker with no user interaction. Affected: BIG-IP APM 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3. Fixed via engineering hotfixes (Hotfix-BIGIP-21.1.0.2.0.30.22, Hotfix-BIGIP-17.5.1.9.0.160.12, Hotfix-BIGIP-17.1.3.5.0.41.14); F5 also offers an emergency iRule mitigation through F5 Support for organizations that cannot immediately apply the hotfix. "The vendor confirmed active exploitation in the wild" (CERT-EU, Security Advisory 2026-013, 2026-09-22); CISA added it to KEV the same day (CISA KEV, catalogue version 2026.09.22) with a 2026-09-25 remediation deadline.
Detection concept, directly from the vendor's own compromise-assessment guidance (vendor-neutral telemetry classes): repeated OAuth "UserInfo" request failures with an "invalid_token" error code from a single source in a short window (F5's own threshold is 10 or more occurrences) in the APM authentication log; an unexplained rise in the failed-OAuth-request counter relative to total OAuth requests, queryable via the platform's internal OAuth statistics; administrative-audit-log review around the same timestamps as any OAuth failure spike, correlated with a TMM process crash or core file caused by the microkernel entering an abort loop. F5's own framing: "at a high level, multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT is the combination that should lead to human review of the system" (CERT-EU, Security Advisory 2026-013, 2026-09-22); no single signal is by itself an indicator of compromise. Triage: an isolated OAuth authentication failure or an occasional TMM restart happens in normal operation; the correlated sequence (failure spike, then suspicious commands, then a TMM crash) is the discriminator. Hardening: inventory every virtual server pairing an APM access policy with an OAuth profile, since the exposure is entirely configuration-gated; apply the engineering hotfix or the emergency iRule; internet-facing instances of this authentication-gateway component are the highest remediation priority.
Cited evidence
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE).
This is a data plane issue; there is no control plane exposure.
The vendor confirmed active exploitation in the wild
At a high level, multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT is the combination that should lead to human review of the system.
It is simple: before the patch, there was no size check before copying the value to the heap buffer, and now there is one.
After configuring the OAuth profile, triggering it was as easy as sending the following request with an Authorization header larger than 0x4100 bytes
Updates1
watchTowr Labs published a patch-diff analysis of CVE-2026-94127 on 2026-09-23 that makes the trigger public. The fix adds a size check before an Authorization header is copied into a heap buffer allocated at 0x4100 bytes on the OAuth UserInfo path; before the patch there was no check, so a longer header overflows the buffer (watchTowr Labs, 2026-09-23). In watchTowr's lab a single GET request to the OAuth userinfo endpoint, carrying a Bearer Authorization header larger than 0x4100 bytes, crashed the traffic-management process (watchTowr Labs, 2026-09-23). watchTowr found that the process binary is not position-independent and that an object holding a function pointer usually landed just past the overflowed buffer in its runs, which lets the overflow redirect execution; SELinux blocked direct process execution, so it turned to the hook script the appliance runs each time the traffic-management process crashes and appended a command to it (watchTowr Labs, 2026-09-23). The request-side signal to add to the authentication-log signals above is therefore an Authorization header far larger than a normal Bearer token sent to the OAuth UserInfo path, followed by a crash and restart of the traffic-management process.
Sources5
Revision history
- Published 2026-09-23T0405Z-intel
- Improvement 2026-09-30T0404Z-intel
watchTowr Labs published a patch-diff analysis on 2026-09-23 that makes the trigger public: an Authorization header longer than 0x4100 bytes sent to the OAuth UserInfo path overflows a fixed heap buffer and crashes the traffic-management process, and watchTowr shows a route from that crash to command execution.
Changed: tags cves sources evidence body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.