F5 Fixes Actively Exploited Zero-Day Flaw in BIG-IP APM

F5 Fixes Actively Exploited Zero-Day Flaw in BIG-IP APM 🚀

Technology company F5 has addressed a critical remote code execution vulnerability in its BIG-IP Access Policy Manager (APM) platform. This flaw, which impacts deployments configured as OAuth authorization servers, was already under active exploitation before the patch was made available. The vulnerability, tracked as CVE-2026-94127, is categorized as a heap-based buffer overflow and has a CVSS score of 9.8.

Key Details:

• The vulnerability affects the BIG-IP system when configured in appliance mode but can only be exploited when both APM and an OAuth authorization server profile are set up. Deployments using APM solely as an OAuth client or resource server are not impacted, according to F5’s advisory.

CISA Involvement:

The US Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild. The Shadowserver Foundation reports that over 15,000 BIG-IP APM deployments are exposed to the internet, with North America and Europe each accounting for around 5,000.

Recommended Actions:

F5 recommends users apply the following hotfixes:

• Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso for the 21.x release branch.
• Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso or Hotfix-BIGIP 17.1.3.5.0.41.14-ENG.iso for the supported 17.5.x and 17.1.x branches.

Additionally, F5 has released an iRule available from the support portal that can be deployed as a temporary mitigation until the patch is applied.

Indicators of Compromise:

F5 advises customers to check installations for several indicators of compromise. The presence of just one indicator is not necessarily a sign of exploitation. A combination of multiple OAuth authentication failures, followed by suspicious commands, and a TMM SIGABRT should prompt a human review of the system.

For further investigation, administrators should monitor logs for repeated OAuth authentication failures, especially from the same IP address. The command to reveal the number of authentication failures is:

tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed

Conclusion:

BIG-IP APM and other F5 devices have been targeted by attackers in recent years, as part of a trend to compromise network edge devices and VPN gateways. Just earlier this month, security researchers discovered a Linux rootkit implant specifically designed for BIG-IP APM systems, linked to the exploitation of an older vulnerability, CVE-2025-5352.

For more details, Read full article