CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM — Detection, Exposure Audit, and Remediation Guide

On September 22, 2026, F5 published a security advisory for CVE-2026-94127, a heap-based buffer overflow in BIG-IP Access Policy Manager (APM) carrying a CVSS v3.1 score of 9.8 (Critical). An unauthenticated attacker with network access to an affected virtual server can achieve remote code execution by sending specifically crafted traffic — no credentials, no valid session, no user interaction required.

There is one important nuance that shapes your triage priority: this vulnerability is not exposed in a default configuration. Exploitation requires a BIG-IP virtual server configured with both an APM access policy and an OAuth profile. That narrows the blast radius, but let me be blunt about what it means in practice: organizations running BIG-IP APM as an identity-aware gateway — fronting corporate applications with OAuth, OpenID Connect, or SAML federation — are precisely the ones in scope. These are internet-facing, internet-reachable boxes sitting at the trust boundary of your enterprise. An RCE here is not a contained event; it is a foothold on a device that brokers authentication for your internal estate, stores session data, and often has line-of-sight to AD, LDAP, and internal application tiers.

Historically, BIG-IP edge vulnerabilities have been weaponized within hours-to-days of disclosure by both criminal and nation-state operators. Do not wait for a public PoC to act. Treat September 22, 2026 as day zero of your response clock.

Technical Analysis

Affected Component and Exposure Conditions

BIG-IP APM provides identity-aware access control for applications and integrates with OAuth, OpenID Connect, and SAML. The vulnerable code path lives in the OAuth profile handling on the data plane — meaning traffic destined for the virtual server itself (not the management interface) is the attack surface. Crafted requests processed by the APM/OAuth handling logic corrupt heap memory, giving the attacker control sufficient for code execution in the context of the BIG-IP data-plane processes.

Attack Chain (Defender's View)

1. Reconnaissance: The attacker enumerates internet-facing BIG-IP virtual servers. APM endpoints are fingerprintable — login pages, /my.policy, OAuth authorization and token endpoints, and characteristic response headers.
2. Trigger delivery: Specifically crafted traffic is sent to a virtual server that has both an access policy and an OAuth profile. No authentication is required because the vulnerable parsing occurs pre-authentication.
3. Heap corruption: Malformed input overflows a heap buffer in the APM data-plane processing path.
4. Code execution: Successful exploitation yields execution on the BIG-IP appliance — typically with the privileges of the data-plane context, which on TMOS is a very privileged place to be. From there, expect credential and session theft, SAML/OAuth token material access, traffic interception, and persistence attempts on the appliance.

Exploitation Status

As of the September 22, 2026 disclosure, Rapid7's Emergent Threat Response analysis characterizes this as a critical unauthenticated code execution vulnerability — with no confirmed in-the-wild exploitation at the time of the advisory. That said, BIG-IP edge bugs have a well-documented history of rapid post-disclosure weaponization. Assume motivated actors are reverse-engineering the patch now. Your exposure audit and patch deployment should be measured in hours and days, not weeks.

Who Is Actually Exposed?

Before you panic-patch everything, run the exposure audit below. You are in scope if all three are true:

• You run BIG-IP with the APM module provisioned
• A virtual server has an access policy attached
• That same virtual server has an OAuth profile (OAuth Client/Resource Server configurations, OAuth profile in the access policy, or OAuth-related per-request policy elements)

Virtual servers with APM policies but no OAuth involvement are not exposed to this specific CVE. Do not let that fact slow you down on the ones that are.

Detection & Response

Detection on BIG-IP is primarily a telemetry-forwarding problem: TMOS syslog (local traffic, APM, and audit logs) must be shipped to your SIEM. If your BIG-IP fleet is not forwarding logs today, fix that as part of this response — you cannot hunt blind.

Sigma Rules

The two highest-fidelity post-exploitation signals on TMOS are (1) data-plane daemon crashes/restarts and core dumps consistent with heap corruption, and (2) shells or command execution spawned by BIG-IP daemons, which essentially never happens legitimately.

---
title: F5 BIG-IP APM Daemon Crash or Core Dump
tid: 9b2c4d71-3f6a-4e58-b1a7-2c8d5e9f4a01
status: experimental
description: Detects crash, restart, or core dump events for BIG-IP APM and data-plane daemons (apmd, tmm, tmrouted) consistent with heap buffer overflow exploitation attempts against CVE-2026-94127.
references:
  - https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm
author: Security Arsenal
date: 2026/09/23
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: linux
  service: syslog
detection:
  selection_process:
    - 'apmd'
    - 'tmm'
    - 'oauthd'
  selection_event:
    - 'segfault'
    - 'core dumped'
    - 'signal 11'
    - 'signal 6'
    - 'restarting'
    - 'unexpectedly terminated'
    - 'panic'
  condition: selection_process and selection_event
falsepositives:
  - Daemon restarts during legitimate software upgrades or configuration loads
  - Resource exhaustion unrelated to attack traffic
level: high
---
title: Suspicious Shell or Command Spawned by F5 BIG-IP Daemon
tid: 4e7a1f93-8c2d-4b65-9d3e-7a1c6f0b2e84
status: experimental
description: Detects shells, interpreters, or download utilities spawned as child processes of BIG-IP APM/data-plane daemons — a strong indicator of post-exploitation following CVE-2026-94127 RCE. Legitimate TMOS operation does not spawn interactive shells from these services.
references:
  - https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm
author: Security Arsenal
date: 2026/09/23
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentProcessName|endswith:
      - '/apmd'
      - '/tmm'
      - '/oauthd'
      - '/httpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor support scripts executed under TAC guidance
  - Custom iCall or monitoring scripts (verify parent chain)
level: critical

KQL (Microsoft Sentinel / Defender)

This hunts F5 syslog forwarded to Sentinel (via CEF or Syslog connector) for daemon crash signatures and anomalous request bursts against OAuth endpoints — the reconnaissance and trigger phases of this attack.

// Hunt 1: BIG-IP daemon crash/restart events consistent with CVE-2026-94127 exploitation attempts
let f5Events = union isfuzzy=true
    (Syslog | where Computer has_any ("bigip", "f5") | project TimeGenerated, HostName=Computer, ProcessName, Message=SyslogMessage),
    (CommonSecurityLog | where DeviceVendor =~ "F5" | project TimeGenerated, HostName=DeviceName, ProcessName=DeviceProcessName, Message);
f5Events
| where Message has_any ("segfault", "core dumped", "signal 11", "signal 6", "panic", "unexpectedly terminated")
   or (ProcessName has_any ("apmd", "tmm", "oauthd") and Message has "restarting")
| summarize EventCount=count(), SampleMessage=any(Message) by HostName, ProcessName, bin(TimeGenerated, 1h)
| order by TimeGenerated desc;
// Hunt 2: Request burst against APM OAuth endpoints (recon / trigger attempts)
CommonSecurityLog
| where DeviceVendor =~ "F5"
| where RequestURL has_any ("/oauth", "/v1/oauth", "/f5-oauth", "/my.policy", "oauth/authorize", "oauth/token")
| summarize RequestCount=count(), DistinctDestinations=dcount(DestinationHostName), DistinctURIs=dcount(RequestURL) by SourceIP, bin(TimeGenerated, 10m)
| where RequestCount > 200
| order by RequestCount desc;

Tune the request-count threshold against your baseline OAuth traffic. A single source IP generating hundreds of requests to OAuth endpoints on a virtual server in ten minutes is not normal user behavior — it is fuzzing or exploit delivery.

Velociraptor VQL

If you run Velociraptor against your TMOS-adjacent Linux infrastructure or have collection capability on the appliance's management plane, this artifact hunts for post-exploitation artifacts: fresh core dumps and anomalous listeners established after the advisory date.

-- Hunt for fresh core dumps and unexpected listeners on F5 BIG-IP TMOS hosts
-- CVE-2026-94127 post-exploitation triage
LET cores = SELECT FullPath, Size, Mtime
FROM glob(globs='/var/core/*')
WHERE Mtime > "2026-09-22"
LET listeners = SELECT Name, Pid, LocalAddress, RemoteAddress, Status
FROM netstat()
WHERE Status =~ 'LISTEN'
   AND NOT LocalAddress =~ ':443|:8443|:22|:161|:4353'
SELECT * FROM cores
UNION ALL
SELECT * FROM listeners

Exposure Audit and Hardening Script

Run this from a bash shell on each BIG-IP (or adapt for BIG-IQ / f5-sdk automation across a fleet). It identifies every virtual server carrying both an access policy and OAuth configuration — your actual CVE-2026-94127 attack surface — and snapshots daemon health for baseline comparison.

#!/bin/bash
# CVE-2026-94127 exposure audit for F5 BIG-IP APM
# Run on each BIG-IP appliance via bash (advanced shell access required)

echo "=== Software version ==="
tmsh show sys version | grep -i -A2 "version"

echo ""
echo "=== Virtual servers with access policies attached ==="
tmsh list ltm virtual one-line | grep -i "apm"

echo ""
echo "=== OAuth profiles present on the system ==="
tmsh list apm oauth one-line 2>/dev/null
tmsh list apm profile oauth one-line 2>/dev/null

echo ""
echo "=== Access policies referencing OAuth ==="
tmsh list apm policy access-policy one-line 2>/dev/null | grep -i oauth

echo ""
echo "=== Virtual server -> profile bindings (review for oauth) ==="
for vs in $(tmsh list ltm virtual one-line | awk '{print $3}'); do
  echo "--- $vs ---"
  tmsh list ltm virtual $vs profiles one-line 2>/dev/null
done

echo ""
echo "=== Daemon health baseline (compare pre/post patch) ==="
bigstart status | grep -E "apmd|tmm|oauthd"
ls -la /var/core/ 2>/dev/null

echo ""
echo "=== Remote syslog destinations configured ==="
tmsh list sys syslog remote-servers one-line 2>/dev/null

Remediation

1. Inventory and scope immediately. Use the audit script above (or the equivalent tmsh/BIG-IQ queries) to enumerate every virtual server with both an APM access policy and an OAuth profile. That list is your patch-first population.
2. Apply the F5 hotfix. F5 has released fixes for supported BIG-IP versions per the September 22, 2026 advisory. Pull the exact fixed version for your branch from the official F5 security advisory on MyF5 (support.f5.com) — hotfixes are branch-specific, and engineering hotfixes require opening a case with F5 Support in some cases. Do not assume your branch's "latest" is the fixed build; verify against the advisory's fixed-version table explicitly.
3. If you cannot patch within 24-48 hours, reduce exposure. Restrict network reachability of exposed virtual servers to known source ranges where business-tolerable (packet filters, upstream ACLs, or AFM policies). Where feasible, temporarily detach the OAuth profile or disable the affected virtual server — this removes the vulnerable code path entirely, at an obvious business cost. There is no iRule-based mitigation for a heap overflow in the data-plane OAuth handling; network-level restriction is your only real bridge control.
4. Hunt before you patch. Patching does not evict an attacker. Before and after applying the hotfix, review daemon crash logs (/var/log/ltm, /var/log/apm, /var/core/), APM session tables for anomalous sessions, and configuration change logs (/var/log/audit) for unauthorized modification. Any core dump or unexplained daemon restart on an exposed virtual server in the past 90 days warrants forensic review of the appliance.
5. Assume credential material is at risk on any exploited appliance. If you find evidence of compromise, rotate SAML signing keys, OAuth client secrets, and any credentials traversing or stored on the device — and treat connected identity infrastructure as suspect.
6. Ensure telemetry forwarding. Confirm remote syslog to your SIEM for ltm, apm, and audit facilities. Local-only logs on a compromised edge device are logs you will never see.
7. Track KEV status. Given the severity class and F5's exploitation history, monitor CISA's Known Exploited Vulnerabilities catalog for CVE-2026-94127 — a KEV listing will carry a federal remediation deadline and should trigger emergency-change procedures in your environment regardless of sector.

Reference: Rapid7 ETR analysis — CVE-2026-94127 and the official F5 security advisory via MyF5 (support.f5.com).

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub