F5 has released emergency engineering hotfixes for a critical zero-day vulnerability in BIG-IP Access Policy Manager (APM), and exploitation is already underway. Tracked as CVE-2026-94127 and scored CVSS 9.8, the flaw is a heap-based buffer overflow that allows an unauthenticated attacker to execute arbitrary code on any BIG-IP system acting as an OAuth authorization server. No login, no credentials, and no access to the management interface is required — the exploit works by sending specially crafted traffic directly to the public-facing virtual server.
The vulnerable configuration combines an APM access policy and an OAuth authorization server profile on the same virtual server. Systems using BIG-IP APM only as an OAuth client or resource server are not affected. F5 disclosed the flaw September 22 alongside hotfixes for supported version branches, and CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog the same day, ordering federal civilian agencies to apply F5’s mitigations by September 25. CERT-EU also published a separate advisory. F5 has not publicly identified how many organizations were hit or which threat actors are behind the attacks.
How to check if you’re affected
Affected versions include all BIG-IP APM releases where an OAuth authorization server profile is in use, across the 17.1.x, 17.5.x, 21.0.x, and other currently supported branches (consult the F5 advisory for the specific hotfix for each branch). Versions at End of Technical Support are of unknown status — F5 did not evaluate them. If your deployment does not configure an OAuth authorization server profile at all, it is not affected regardless of version.
For active compromise, F5 and CERT-EU recommend checking for these signals in combination: repeated failed UserInfo requests in /var/log/apm citing “The access token is invalid” — especially 10 or more from a single IP in a short window; an unexplained rise in total_failed when running tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed; suspicious commands in /var/log/audit around those failure timestamps; and any TMM SIGABRT events or core files near the same timeframe. Installing the hotfix does not confirm whether an attacker has already established access, so forensic triage should precede patching where operationally feasible.