CVE-2026-94127: F5 BIG-IP APM Unauthenticated RCE Exploited in the Wild — Emergency Detection and Remediation Guide

---
title: BIG-IP APM Service Spawning Interactive or Scripting Shell
description: Detects suspicious shell or interpreter execution parented to BIG-IP web/traffic services after possible APM exploitation. Intended for Linux/BIG-IP process telemetry forwarded via syslog/EDR.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://securityaffairs.com/199619/security/f5-big-ip-apm-zero-day-exploited-in-zero-day-rce-attacks.html
author: Security Arsenal
date: 2026/08/07
status: experimental
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|contains:
      - '/httpd'
      - '/tmm'
      - '/apm'
      - '/java'
      - '/bd'
      - '/icrd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Rare F5 support scripts and iCall/iApp maintenance; validate against change records and support cases.
level: high
---
title: Suspicious APM Request Pattern Before Authentication
description: Detects anomalous requests to APM endpoints with encoded traversal, oversized bodies, or command-like metacharacters prior to session establishment. Use with WAF/ASM/APM request logs, not as a sole indicator.
references:
  - https://attack.mitre.org/techniques/T1190/
  - https://securityaffairs.com/199619/security/f5-big-ip-apm-zero-day-exploited-in-zero-day-rce-attacks.html
author: Security Arsenal
date: 2026/08/07
status: experimental
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    uri|contains:
      - '/my.policy'
      - '/vdesk/'
      - '/sam/'
      - '/oauth/'
      - '/apm/'
      - '/f5vpn/'
  selection_payload:
    uri|contains:
      - '%2e%2e'
      - '%252e'
      - '%00'
      - 'cmd='
      - 'exec='
      - '/bin/sh'
      - '/bin/bash'
      - '${IFS}'
  condition: selection_uri and selection_payload
falsepositives:
  - Scanner noise and broken SSO clients; require correlation with new processes, file writes, config commits, or admin logins.
level: medium
---
title: Unexpected BIG-IP Configuration Commit or Local Admin Change
description: Detects config saves/commits, new local users, SSH key changes, or management-plane commands around an APM exploitation window. Map to centralized syslog from BIG-IP audit logs.
references:
  - https://attack.mitre.org/techniques/T1136/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/08/07
status: experimental
tags:
  - attack.persistence
  - attack.t1136
  - attack.defense_evasion
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'EXECVE'
    argc|gte: 1
    a0|contains:
      - 'tmsh'
      - 'useradd'
      - 'adduser'
      - 'usermod'
      - 'sshd'
      - 'bash'
    a1|contains:
      - 'create auth user'
      - 'modify auth user'
      - 'save sys config'
      - 'load sys config'
      - 'modify ltm virtual'
      - 'create ltm virtual'
      - 'authorized-keys'
      - '/config/ssh'
  condition: selection
falsepositives:
  - Legitimate automation and change windows; alert when outside approved change tickets or from unknown admin source IPs.
level: high

let window_start = ago(14d);
union isfuzzy=true
(
CommonSecurityLog
| where TimeGenerated >= window_start
| where DeviceVendor =~ "F5" or DeviceProduct has_any ("BIG-IP","APM","ASM","Advanced WAF")
| extend uri = coalesce(RequestURL, RequestContext, AdditionalExtensions)
| where uri has_any ("/my.policy","/vdesk/","/sam/","/oauth/","/apm/","/f5vpn/")
   or Message has_any ("%2e%2e","%252e","%00","/bin/sh","/bin/bash","cmd=","exec=","${IFS}")
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod, uri, Message, DeviceName, DeviceAction, Severity
),
(
Syslog
| where TimeGenerated >= window_start
| where Computer has_any ("bigip","f5","ltm","apm") or Facility in ("local0","local1","daemon","audit")
| where SyslogMessage has_any ("tmsh","save sys config","create auth user","modify auth user","authorized-keys","/bin/sh","/bin/bash","tmm","httpd","APM")
| project TimeGenerated, Computer, Facility, SeverityLevel, HostIP, ProcessName, SyslogMessage
),
(
DeviceProcessEvents
| where TimeGenerated >= window_start
| where InitiatingProcessFileName has_any ("httpd","tmm","java","icrd","bd","apm")
   and FileName in~ ("sh","bash","dash","python","python3","perl","curl","wget","nc","ncat")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
)
| order by TimeGenerated desc;

-- Velociraptor hunt for post-exploitation artifacts on Linux/BIG-IP-like hosts.
-- Deploy only where supported/approved; BIG-IP itself is usually triaged via UCS, tmsh, and syslog export rather than an agent.
LET suspicious_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(/bin/sh|/bin/bash|python|perl|curl|wget|nc|ncat)'
   OR Exe =~ '/(tmp|var/tmp|dev/shm)/'

LET suspicious_files = SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=['/tmp/**','/var/tmp/**','/dev/shm/**','/config/ssh/**','/root/.ssh/**','/home/*/.ssh/**'])
WHERE Mtime > now() - 14*24*3600
   AND (FullPath =~ 'authorized_keys' OR FullPath =~ '\.(sh|py|pl|elf|so)$' OR Mode =~ '777')

LET listeners = SELECT * FROM netstat()
WHERE State =~ 'LISTEN' AND (Laddr.Port in [22,443,8443,10443] OR Raddr.IP =~ '^(0\.0\.0\.0|::)$')

SELECT 'process' AS ArtifactType, * FROM suspicious_procs
UNION ALL
SELECT 'file' AS ArtifactType, FullPath AS Name, NULL AS Pid, NULL AS Ppid, FullPath AS Exe, Mode AS CommandLine, NULL AS Username, Mtime AS CreateTime FROM suspicious_files
UNION ALL
SELECT 'listener' AS ArtifactType, Laddr.IP AS Name, PID AS Pid, NULL AS Ppid, Status AS Exe, Laddr.Port AS CommandLine, NULL AS Username, NULL AS CreateTime FROM listeners

# Run on BIG-IP bash/advanced shell with appropriate privileges. Read-only verification first.
set -euo pipefail
TS=$(date -u +%Y%m%dT%H%M%SZ)
OUT="/var/tmp/f5_cve_2026_94127_check_${TS}"
mkdir -p "$OUT"

{
  echo "=== identity/version ==="
  tmsh show sys version
  tmsh list sys provision
  echo "=== HA/sync ==="
  tmsh show cm failover-status 2>/dev/null || true
  tmsh show cm sync-status 2>/dev/null || true
  echo "=== APM exposure ==="
  tmsh list ltm virtual one-line | egrep -i 'apm|access|profile|destination' || true
  tmsh list apm profile access one-line 2>/dev/null || true
  echo "=== listeners/routes ==="
  netstat -lntup 2>/dev/null | egrep ':(22|80|443|8443|10443)\b' || true
  tmsh list net self one-line
  tmsh list net route one-line | head -200
  echo "=== management plane guardrails ==="
  tmsh list sys httpd one-line | egrep -i 'allow|ssl|auth' || true
  tmsh list sys sshd one-line | egrep -i 'allow|banner|port' || true
  tmsh list sys management-ip one-line 2>/dev/null || true
  echo "=== recent admin/auth/config indicators ==="
  tail -n 500 /var/log/audit 2>/dev/null | egrep -i 'tmsh|create auth user|modify auth user|save sys config|load sys config|authorized-keys' || true
  tail -n 300 /var/log/secure 2>/dev/null | egrep -i 'Accepted|Failed|session opened|sudo|su:' || true
  echo "=== suspicious recent files ==="
  find /tmp /var/tmp /dev/shm /config/ssh /root/.ssh /home/*/.ssh -type f -mtime -14 -printf '%TY-%Tm-%Td %TH:%TM:%TS %m %u %g %p\n' 2>/dev/null | sort || true
  echo "=== suspicious processes ==="
  ps auxww | egrep '/(bin/)?(sh|bash|dash|python3?|perl|curl|wget|nc|ncat)\b' | egrep -v 'egrep|f5_cve_2026_94127_check' || true
} | tee "$OUT/f5_check.txt"

tmsh save sys config
qkview -s0 -f "$OUT/support.qkview" >/dev/null 2>&1 || true
chmod 600 "$OUT"/* 2>/dev/null || true

echo "Evidence bundle: $OUT"
echo "Next: compare installed build to F5 fixed builds for CVE-2026-94127, remove untrusted exposure, patch standby/HA first, then rotate credentials/keys if integrity is uncertain."