Critical F5 BIG-IP Zero-Day: Unauthenticated RCE Exploited in the Wild — Detection and Remediation Guide

SecurityWeek has reported that a critical vulnerability in F5 BIG-IP is being exploited as a zero-day, allowing unauthenticated attackers to send malicious traffic to a vulnerable BIG-IP instance and achieve remote code execution. If you operate BIG-IP — as an application delivery controller, WAF (Advanced WAF/ASM), access gateway (APM), or DNS service (GTM/BIG-IP DNS) — treat this as an active incident condition, not a routine patching cycle.

I've led IR engagements where edge appliances were the initial access vector, and the pattern is consistent: the management or control-plane interface gets exposed to the internet, an unauthenticated RCE drops, and the appliance becomes a persistence point that survives endpoint tooling because nothing is watching it. BIG-IP sits at a trust boundary with visibility into decrypted traffic, session tokens, and internal routing. Compromise of the box is compromise of everything behind it.

Your immediate priorities:

1. Confirm whether any BIG-IP management interface (Configuration utility/TMUI, iControl REST on TCP/443) is reachable from untrusted networks.
2. Audit the appliance for signs of prior compromise before patching — patching a breached box without forensics destroys evidence.
3. Apply F5's guidance the moment a fix or mitigation is published, and implement the workarounds below in the interim.

Technical Analysis

What We Know

Per the reporting, the flaw allows an unauthenticated remote attacker to execute code on BIG-IP by sending crafted traffic to the device. No authentication, no user interaction — this is the worst-case exploitation profile for an internet-facing network appliance. Active exploitation is confirmed, which is why it is being characterized as a zero-day.

At time of writing, F5's advisory is the authoritative source for the exact affected modules, versions, and fixed releases. Do not rely on secondhand summaries for version scoping — pull the advisory directly from F5's security advisory portal (my.f5.com/manage/s/article/K000... series) and cross-reference any CISA KEV addition, which historically follows quickly for exploited BIG-IP flaws.

Affected Components and Exposure Model

Historically, unauthenticated BIG-IP RCEs cluster in two attack surfaces, and defenders should assume both are in scope until F5 says otherwise:

• Configuration utility (TMUI) — the web management interface, typically TCP/443 on the management IP. Must never be internet-reachable. In every BIG-IP IR I've worked, internet-exposed TMUI was either the vector or the gift that kept on giving.
• iControl REST — the REST API (also TCP/443) used for automation. Unauthenticated or improperly scoped iControl REST endpoints have been the root cause of prior critical BIG-IP RCEs.

Exploitation Mechanics (Defender's View)

An unauthenticated request reaching the vulnerable component results in command execution in the appliance's context. Observable post-exploitation behaviors on BIG-IP typically include:

• The web service or management process (httpd, tomcat, or the restjavad/restnoded daemons) spawning shells or unexpected child processes (bash, sh, python, perl, curl, wget).
• Execution of tmsh commands by users who don't normally run them — particularly tmsh save /sys config, tmsh list /auth user, or creation of new local admin accounts.
• Dropped files in web-served directories (e.g., under /var/www/, /usr/local/www/, or iControl/TMUI paths) functioning as webshells.
• Outbound connections from the appliance to unfamiliar external IPs — BIG-IP should have a tightly known egress profile; anything novel is suspect.
• New or modified entries in /etc/cron.d/, /config/startup, or iApp/iCall scripts used as persistence.

Exploitation Status

• Active in-the-wild exploitation: Confirmed per the SecurityWeek report (exploited as a zero-day).
• Public PoC: Expect rapid PoC development and scanner mass-exploitation once details surface — prior critical BIG-IP flaws went from disclosure to broad scanning within 24–72 hours.
• CISA KEV: Monitor the KEV catalog; exploited F5 flaws are routinely added with a short federal remediation deadline, which is also a useful internal forcing function for your change board.

Detection & Response

Detection on BIG-IP itself means harvesting its native logs: /var/log/audit (tmsh/audit events), /var/log/ltm, /var/log/restjavad.*.log, and the web access logs for the Configuration utility. Forward all of these to your SIEM via syslog if you aren't already — if you're not ingesting BIG-IP logs today, that gap is a finding in itself.

Sigma Rules

The following rules target the post-exploitation behaviors described above. The first covers shell/command execution spawned from BIG-IP service contexts (for environments running endpoint or eBPF-based telemetry on the appliance or virtual editions); the second detects suspicious iControl REST / management-plane requests in forwarded web logs.

---
title: BIG-IP Service Process Spawning Shell or Command Interpreter
id: 3f8c2a71-9b4e-4d1a-a6c7-5e2f8d0b1c3a
status: experimental
description: Detects BIG-IP web/REST service daemons spawning shells or command interpreters, consistent with post-exploitation activity following unauthenticated RCE against the management or iControl REST interface.
references:
  - https://www.securityweek.com/critical-f5-big-ip-vulnerability-exploited-as-zero-day/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'httpd'
      - 'tomcat'
      - 'restjavad'
      - 'restnoded'
      - 'java'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/python'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate F5 iCall or iApp automation executing scripts under the java service context
level: high
---
title: Suspicious iControl REST or TMUI Request Pattern on BIG-IP
id: 8a1d4e62-7c3b-4f5e-b2d9-6a0c1e4f7b2d
status: experimental
description: Detects HTTP requests to BIG-IP management endpoints consistent with exploitation attempts against iControl REST or the Configuration utility, including POSTs to bash execution endpoints and requests with embedded command characters.
references:
  - https://www.securityweek.com/critical-f5-big-ip-vulnerability-exploited-as-zero-day/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri|contains:
      - '/mgmt/tm/util/bash'
      - '/mgmt/tm/util/unix-ls'
      - '/mgmt/tm/util/unix-mv'
      - '/mgmt/shared/authn/login'
      - '/tmui/login.jsp'
  selection_injection:
    cs-uri|contains:
      - ';'
      - '%3b'
      - '|'
      - '%7c'
      - '$('
      - '%24%28'
      - '`'
      - '%60'
  condition: selection_endpoint or selection_injection
falsepositives:
  - Legitimate automation calling iControl REST bash utility endpoints from known orchestration hosts (filter on source IP allowlist)
level: high

KQL — Microsoft Sentinel Hunt

Assuming BIG-IP forwards syslog to Sentinel (via a Linux syslog collector or CEF), hunt the audit and service logs for exploitation-adjacent events: unauthenticated requests to management endpoints, tmsh account manipulation, and shell execution references.

// Hunt: BIG-IP management-plane exploitation indicators in forwarded syslog
let timerange = 7d;
Syslog
| where TimeGenerated > ago(timerange)
| where Computer has_any ("bigip", "f5") or Facility in ("local0", "local1")
| where SyslogMessage has_any (
    "/mgmt/tm/util/bash",
    "/mgmt/shared/authn/login",
    "unix-mv",
    "unix-ls"
  )
  or (SyslogMessage has "tmsh" and SyslogMessage has_any (
      "create auth user",
      "modify auth user",
      "save /sys config",
      "list /auth user"
  ))
  or (SyslogMessage has_any ("bash", "/bin/sh", "curl", "wget") and ProcessName has_any ("httpd", "restjavad", "tomcat"))
| project TimeGenerated, Computer, ProcessName, Facility, SeverityLevel, SyslogMessage, HostIP
| order by TimeGenerated desc;

Follow up with an exposure check: query CommonSecurityLog (firewall/edge device logs) for inbound connections to your BIG-IP management IPs on TCP/443 from external sources. Any hit means your management interface is — or was — reachable from the internet, which is itself a critical finding independent of this CVE.

Velociraptor VQL — Appliance Forensic Hunt

For BIG-IP Virtual Editions or any Linux host where you can run Velociraptor, hunt for webshell artifacts in web-served paths and recently modified persistence locations.

-- Hunt for webshell-like files and persistence artifacts on BIG-IP/VE filesystems
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/var/www/**/*.jsp',
  '/var/www/**/*.php',
  '/usr/local/www/**/*.jsp',
  '/etc/cron.d/*',
  '/config/startup',
  '/shared/tmp/*.sh',
  '/var/tmp/*'
])
WHERE Mtime > (now() - 60 * 60 * 24 * 7)
   AND NOT FullPath =~ '(?i)f5|default|template'
ORDER BY Mtime DESC

Also review live process state for service-context shells:

-- Shells or interpreters spawned by web/REST service contexts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(bash|/bin/sh|python|perl|curl|wget|nc )'
   AND Username =~ '(?i)(apache|tomcat|restjavad|nobody|www)'

Verification and Hardening Script

Run the following on the BIG-IP bash shell (or via SSH) to inventory exposure, audit state, and hunt for common indicators. Review output manually — do not auto-remediate on a production ADC without change control, but do not delay the audit.

#!/bin/bash
# BIG-IP zero-day exposure and compromise audit — run as root via SSH
# Review all output before making any changes.

echo "=== [1] Software version (compare against F5 advisory fixed versions) ==="
tmsh show /sys version | grep -i -A2 "Version"

echo "=== [2] Management interface self-IPs and port lockdown (verify 443/22 are not on data-plane self-IPs) ==="
tmsh list /net self | grep -E "address|allow-service"

echo "=== [3] httpd/management ACL — allowed address ranges for Configuration utility ==="
tmsh list /sys httpd | grep -i allow

echo "=== [4] Local user accounts — look for unexpected admins ==="
tmsh list /auth user | grep -E "auth-user|role|partition-access"

echo "=== [5] Recent audit log events — account creation, config saves, bash util calls ==="
grep -iE "create|modify|bash|unix-mv|unix-ls" /var/log/audit 2>/dev/null | tail -50

echo "=== [6] Web-served directories — files modified in the last 7 days ==="
find /var/www /usr/local/www -type f -mtime -7 2>/dev/null

echo "=== [7] Persistence locations ==="
ls -la /etc/cron.d/ /config/startup 2>/dev/null
tmsh list /sys icall script 2>/dev/null

echo "=== [8] Outbound connections from the appliance — baseline review ==="
netstat -tnp 2>/dev/null | grep ESTABLISHED | grep -v "127\.\|::1"

echo "=== [9] Shells running under service accounts ==="
ps aux | grep -E "apache|tomcat|nobody" | grep -E "bash|/bin/sh|python|perl"

echo "=== Audit complete. Preserve /var/log/audit, /var/log/ltm, and restjavad logs before patching. ==="

Remediation

Act in this order:

1. Eliminate exposure today. Confirm the Configuration utility and iControl REST are unreachable from the internet and from untrusted internal segments. Restrict /sys httpd allow to a dedicated management subnet or jump host only, and remove 443/22 from allow-service on any data-plane self-IP. This is the highest-value mitigation regardless of patch status — an unauthenticated RCE you cannot reach is not exploitable.
2. Capture evidence before patching. Export /var/log/audit, /var/log/ltm, web access logs, and restjavad logs. If any indicator from the audit script fires, treat the appliance as compromised: full forensic review, credential rotation for all local accounts and any secrets the appliance could access (including TLS private keys on the box), and consider rebuilding from a clean UCS archive or fresh install.
3. Apply F5's fix immediately upon release. Pull the advisory and fixed version matrix directly from F5's advisory portal (my.f5.com → Security Advisories) — do not trust third-party version summaries. Watch for a CISA KEV listing; KEV deadlines for exploited F5 flaws are typically aggressive (often 7 days or less for federal agencies) and are a sound benchmark for private-sector SLAs on internet-facing appliances.
4. Rotate credentials and keys on any potentially exposed device. Assume that an exploited appliance leaked local admin credentials, LDAP/RADIUS bind passwords, API tokens used by automation, and private keys for hosted virtual servers.
5. Verify log forwarding. Confirm BIG-IP audit, LTM, and REST daemon logs are flowing to your SIEM and are covered by the detections above. If BIG-IP telemetry isn't in your SIEM, close that gap this week — edge appliances are blind spots in most environments, and attackers know it.
6. Reassess architecture. If business requirements demand remote BIG-IP administration, put it behind a VPN or zero-trust broker with MFA — never on a routable interface. This incident is another data point in the multi-year pattern of exploitation against edge management planes (F5, Citrix, Ivanti, Palo Alto); management interfaces on the internet is a posture decision your adversaries are counting on.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub