CVE-2026-94127: F5 BIG-IP APM OAuth Unauthenticated RCE — Detection and Remediation Guide

NVD has published CVE-2026-94127 as a CVSS 9.8 Critical, network-exploitable vulnerability affecting F5 BIG-IP when a BIG-IP APM access policy and an OAuth profile are configured on the same virtual server. Per the advisory summary, specific malicious traffic sent to that data-plane virtual server can produce unauthenticated code execution. Appliance mode is also vulnerable, so teams should not assume that locked-down Appliance mode changes the risk decision. This is described as a data-plane issue only; the advisory summary states there is no control-plane exposure.

The operational takeaway is simple: any internet-facing or partner-reachable BIG-IP APM virtual server that terminates OAuth should be treated as a priority-one remediation target. Until F5 fixed builds are identified and applied for your exact branch, assume the configuration path is targetable and reduce exposure now. The source also notes that versions past End of Technical Support are not evaluated, which means EoTS systems must be treated as potentially vulnerable and upgraded or retired, not merely documented.

Technical Analysis

Affected condition from the published summary:

• Product: F5 BIG-IP, specifically deployments using BIG-IP APM.
• Required configuration: an APM access policy and an OAuth profile configured on a virtual server.
• Attack surface: data plane only; no control-plane exposure is described.
• Attacker position: remote, network-adjacent or internet-reachable depending on virtual-server exposure; no authentication required.
• Impact: unauthenticated code execution on the BIG-IP data plane.
• Severity: CVSS 9.8 Critical, network vector.
• Deployment note: BIG-IP in Appliance mode is still vulnerable.
• Lifecycle note: EoTS releases are not evaluated, so absence of a fixed-version statement for an old branch is not evidence of safety.

The precise vulnerable code path is not enumerated in the provided summary, and defenders should not invent a root cause. What matters for detection engineering is the exploitation boundary: hostile traffic enters through a virtual server where APM and OAuth converge, then execution follows in the BIG-IP data-plane context. Post-exploitation on BIG-IP often looks different from a typical Windows server. Look for unexpected child processes under BIG-IP service processes, shells or interpreters launched outside normal administrative shells, crashes or restarts in data-plane services, suspicious outbound connections from self IPs or VLANs that normally do not initiate internet traffic, and new files in writable BIG-IP paths such as /shared/tmp, /var/tmp, /tmp, or /config unless a change window explains them.

Exploitation status from the supplied item: no public PoC, no confirmed in-the-wild exploitation, and no CISA KEV inclusion are stated in the source. Do not interpret that as low urgency. A CVSS 9.8 unauthenticated RCE in an edge identity and access component is exactly the class of bug that moves quickly from publication to scanning once exploit details emerge. Confirm current status directly against F5 advisory channels, NVD, and CISA KEV during triage.

Immediate scoping questions for your environment:

1. Which BIG-IP virtual servers have both an APM access profile and OAuth profile attached?
2. Which of those virtual servers are reachable from the internet, extranet, CDN egress, partner networks, or untrusted internal segments?
3. Which devices or virtual editions are running EoTS software or branches without a clearly mapped fixed release?
4. Are BIG-IP syslog, audit, AFM, LTM/APM policy logs, DNS, egress firewall, and NetFlow telemetry centralized into Sentinel or your SIEM?
5. Do you have a maintenance path to remove OAuth/APM from nonessential VIPs temporarily without breaking SSO federation flows?

Detection & Response

The highest-value detections are post-exploitation behaviors and exposure validation, because the pre-auth trigger string is not public in the supplied summary. Avoid broad rules that alert on every OAuth request to APM; that will drown the SOC. Focus on execution descendants of BIG-IP service processes, service instability around APM/OAuth VIPs, and egress initiated by BIG-IP self IPs.

Sigma note: BIG-IP appliances do not naturally emit Sysmon-style process events. Deploy these where BIG-IP VE or adjacent Linux collectors forward auditd/Syslog process telemetry, or where your EDR supports the BIG-IP host. Network telemetry should come from AFM/LTM logs, firewall, NetFlow, and egress controls.

---
title: BIG-IP Service Process Spawning Shell or Interpreter
id: 2c7d6a51-9412-4f27-b8aa-cve202694127
status: experimental
description: Detects shells, script interpreters, or download cradles launched under BIG-IP data-plane or web service context after possible CVE-2026-94127 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94127
author: Security Arsenal
date: 2026/06/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  parent_service:
    ParentImage|endswith:
      - '/tmm'
      - '/httpd'
      - '/mcpd'
      - '/bigd'
  child_exec:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: parent_service and child_exec
falsepositives:
  - Rare F5 support diagnostics or iControl automation launched under service context
  - Vendor scripts during hotfix installation; correlate with change tickets
level: critical
---
title: Writable BIG-IP Paths Followed by Execution
id: 7b9f0e22-3f58-4aa6-9d21-6e41c0a7d111
status: experimental
description: Detects execution of files from writable BIG-IP staging directories, consistent with post-exploitation payload staging after an edge service compromise.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94127
author: Security Arsenal
date: 2026/06/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  staging_path:
    Image|startswith:
      - '/shared/tmp/'
      - '/var/tmp/'
      - '/tmp/'
    CommandLine|contains:
      - '/shared/tmp/'
      - '/var/tmp/'
      - '/tmp/'
  exclude_known_admin:
    User|contains:
      - 'root'
    CommandLine|contains:
      - 'f5'
      - 'tmsh'
      - 'imsh'
  condition: staging_path and not exclude_known_admin
falsepositives:
  - Manual administrator troubleshooting in /tmp; require change record correlation
level: high

KQL for Microsoft Sentinel assumes BIG-IP syslog/CEF is forwarded and normalized. Tune HostName/DeviceProduct values to your inventory; keep the logic focused on instability around APM/OAuth and suspicious process or egress artifacts rather than raw OAuth volume.

let lookback = 24h;
let bigip_hosts = dynamic(['bigip', 'f5', 'ltm', 'apm']);
let suspicious_terms = dynamic(['oauth', 'apm', 'tmm', 'segfault', 'panic', 'core dumped', 'child process', 'CVE-2026-94127']);
union isfuzzy=true
  (Syslog
   | where TimeGenerated >= lookback
   | where HostName has_any (bigip_hosts) or Facility in ('local0','local1','daemon','kern')
   | where SyslogMessage has_any (suspicious_terms)
   | project TimeGenerated, HostName, SeverityLevel, ProcessName, SyslogMessage),
  (CommonSecurityLog
   | where TimeGenerated >= lookback
   | where DeviceProduct has_any (bigip_hosts) or SourceHostName has_any (bigip_hosts)
   | where Message has_any (suspicious_terms) or AdditionalExtensions has_any (suspicious_terms)
   | project TimeGenerated, SourceHostName, DeviceProduct, DeviceAction, SourceIP, DestinationIP, DestinationPort, Message, AdditionalExtensions),
  (DeviceProcessEvents
   | where TimeGenerated >= lookback
   | where InitiatingProcessFileName in~ ('tmm','httpd','mcpd','bigd')
   | where FileName in~ ('sh','bash','dash','python','python3','perl','curl','wget','nc','ncat','socat')
   | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName)
| order by TimeGenerated desc

Velociraptor is most realistic for BIG-IP Virtual Edition Linux hosts, management jump boxes, or EDR-covered collectors rather than closed appliances. Use it to validate descendants and staging artifacts during an IR sweep.

-- Hunt for suspicious descendants of BIG-IP services and payload staging on Linux VE or collector hosts
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Exe =~ '/(tmm|httpd|mcpd|bigd)$' OR CommandLine =~ '(tmm|httpd|mcpd|bigd)')
  AND (Name =~ '^(sh|bash|dash|python|python3|perl|curl|wget|nc|ncat|socat)$' OR CommandLine =~ '(base64|/dev/tcp|/shared/tmp|/var/tmp|/tmp/)')

-- Sweep writable staging directories for recently created executables or archives
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/shared/tmp/*','/var/tmp/*','/tmp/*','/config/*.tmp','/config/upload/*'])
WHERE Mtime > now() - 86400
  AND (FullPath =~ '\.(sh|py|pl|elf|bin|so|tar|tgz|gz|zip)$' OR Size > 1048576)
ORDER BY Mtime DESC

Response workflow:

1. Snapshot the current configuration and preserve logs before remediation: UCS archive, qkview if directed by F5 support, remote syslog buffers, AFM/LTM/APM logs, egress firewall, DNS, NetFlow, and authentication provider logs.
2. Identify every VIP with both APM access policy and OAuth profile. Rank by internet reachability, business criticality, and data sensitivity behind the VIP.
3. If compromise is suspected, isolate at the data plane without blindly failing over a potentially compromised active unit into production. Capture volatile state first where supportable, then fail over cleanly according to your IR runbook.
4. Rotate OAuth client secrets, signing keys, certificates private keys if exposed on-device, session/token material, downstream API credentials reachable from BIG-IP, and any service accounts used by APM. Assume token replay risk until logs prove otherwise.
5. Hunt downstream: web/app servers behind the VIP, identity provider logs, SSO session anomalies, new OAuth grants, and admin API calls following first malicious traffic window.

Remediation

Apply the F5 fixed release for your exact BIG-IP branch as soon as the vendor advisory mapping is confirmed. The supplied NVD summary does not list fixed version numbers, so do not guess them from community posts and do not postpone action while waiting for a perfect patch matrix. Use the NVD entry and F5 advisory as the canonical sources, and verify CISA KEV status for any federal or contractual remediation deadline.

Authoritative references:

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94127
• F5 security advisory: follow the F5 advisory linked from NVD and F5 Support for fixed builds, affected modules, and hotfix instructions.

Interim risk reduction where patching cannot happen immediately:

• Remove or disable the OAuth profile on affected virtual servers if the flow is not strictly required, or split OAuth termination away from the same data-plane VIP if architecture permits.
• If APM access policy is not required on a VIP, remove it. Do not rely on an iRule as a code-execution fix; use iRules only for traffic shaping while engineering the real fix.
• Enforce positive allowlisting in front of affected VIPs: known OAuth callback/source networks, WAF/ASM signatures where applicable, AFM address lists, rate limiting, GEO/IP reputation, and denial of nonessential methods. This reduces exploit opportunity but is not a patch substitute.
• Block outbound internet from BIG-IP self IPs except approved update, NTP, DNS, OCSP/CRL, IdP, and support destinations. Alert on any new egress destination.
• Ensure management interfaces remain unreachable from untrusted networks even though this issue is data plane. Compromise of data plane plus exposed management is how contained events become enterprise events.
• Upgrade EoTS/EoL devices. Because EoTS releases are not evaluated, the safest statement is unsupported equals unmanaged risk.
• Validate HA pairs and device service clusters: confirm both units are inventoried, patched consistently, config-synced, and not running different exposure profiles.

Use this Bash inventory script from a trusted admin host with SSH access to BIG-IP. It is read-only by design and creates an exposure evidence bundle for change control.

#!/usr/bin/env bash
set -euo pipefail

# Usage: ./bigip_cve_2026_94127_inventory.sh admin@bigip-a.example.com
TARGET="${1:?usage: $0 user@bigip-host}"
OUT="bigip-exposure-$(date -u +%Y%m%dT%H%M%SZ).txt"

ssh -o BatchMode=yes -o ConnectTimeout=10 "$TARGET" 'bash -lc '
  'echo === identity ===; tmsh list sys global-settings hostname;'
  'echo === software ===; tmsh show sys software; tmsh list sys software all;'
  'echo === sync ===; tmsh show cm sync-status;'
  'echo === self ips ===; tmsh list net self all-properties;'
  'echo === virtual servers with apm oauth context ===; tmsh list ltm virtual all-properties | grep -Ei "virtual|destination|profiles|apm|oauth|access|pool|rules";'
  'echo === apm access profiles ===; tmsh list apm profile access all-properties 2>/dev/null || true;'
  'echo === oauth objects ===; tmsh list apm oauth all-properties 2>/dev/null || true; tmsh list ltm profile oauth all-properties 2>/dev/null || true;'
  'echo === httpd management exposure ===; tmsh list sys httpd all-properties;'
  'echo === recent service restarts ===; grep -Ei "tmm|mcpd|httpd|apm|oauth|segfault|panic|core" /var/log/ltm /var/log/apm 2>/dev/null | tail -200 || true'
'' > "$OUT"

echo "Wrote $OUT"
echo "Review for VIPs containing both APM/access and OAuth, EoTS software, and unexpected egress/self-IP exposure."

Validation after remediation should include: fixed build confirmed in tmsh show sys software; vulnerable VIP configuration removed or patched; no new service crashes in /var/log/ltm and /var/log/apm; egress firewall shows no new self-IP destinations; synthetic OAuth flows succeed without enabling broad inbound rules; and a targeted external exposure scan confirms only required listeners remain.

Category

vulnerability-management

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub