F5 BIG-IP APM Unauthenticated RCE Zero-Day Exploited in the Wild — Detection, Hardening, and Emergency Response Guide

F5 has released emergency security updates addressing a critical unauthenticated remote code execution vulnerability in BIG-IP Access Policy Manager (APM). Per F5's disclosure and reporting from BleepingComputer, the flaw is already being exploited in attacks — this is not a theoretical CVSS exercise. Any organization running BIG-IP APM with a management or virtual server interface reachable from untrusted networks should assume exposure until patched and should treat every exposed appliance as a potential intrusion, not merely a vulnerable asset.

I've led IR engagements on multiple BIG-IP compromises over the years, and the pattern is always the same: edge devices are the soft underbelly of the perimeter. They run powerful, internet-facing code, they sit in front of your most sensitive applications, and they are almost universally under-monitored compared to Windows endpoints. Attackers know this. When an unauthenticated RCE drops on a BIG-IP APM module, the exploitation window between public disclosure and widespread scanning is measured in hours, not days.

This post covers what we know about the flaw, how exploitation manifests on a compromised appliance, how to hunt for compromise with the telemetry you actually have, and how to remediate on an emergency timeline.

Technical Analysis

What Is Affected

• Product: F5 BIG-IP with the Access Policy Manager (APM) module provisioned
• Impact: Unauthenticated remote code execution — an attacker with network access to a vulnerable listener can execute arbitrary commands on the underlying TMOS system, typically with elevated privileges
• Exposure surface: APM virtual servers and, critically, any instance where the BIG-IP Configuration utility / management interface is reachable from the internet or untrusted network segments

Affected version ranges and fixed builds are enumerated in F5's security advisory. Because F5 advisories map vulnerable versions to specific hotfix builds per release train (e.g., 17.x, 16.x, 15.x), pull the exact fixed version for your train directly from F5's security advisory page via the F5 Security Advisories portal rather than relying on third-party summaries. Verify against your current build with tmsh show sys version.

How the Attack Works (Defender's View)

Based on the exploitation patterns consistent with this class of BIG-IP APM flaw and F5's historical RCE disclosures, the attack chain defenders should model is:

1. Reconnaissance: Internet-wide scanning for exposed BIG-IP APM virtual servers and management interfaces (typically TCP 443/8443). Tools like Shodan and Censys make target enumeration trivial.
2. Initial access: An unauthenticated HTTP request targeting the vulnerable APM component achieves command execution on the TMOS host. No credentials, no session, no user interaction required.
3. Post-exploitation: Successful exploitation on BIG-IP consistently produces a recognizable pattern:
   • Web shell or implant dropped to the filesystem (common landing spots: /var/tmp/, /var/log/, /shared/tmp/, or paths served by the HTTP daemon such as /var/usr/rest/ or web root directories)
   • Execution of system binaries via tmsh or direct shell invocation to disable logging, create users, or harvest credentials
   • Persistence via modified startup scripts, cron, or injected configuration
   • Credential theft — APM often holds AD-integrated authentication material, session databases, and LDAP bind credentials, making a compromised APM box a beachhead into the identity plane
4. Pivot: From the BIG-IP, attackers move to internal resources the device fronts — because BIG-IP sits in a privileged network position with broad east-west reachability.

Exploitation Status

• Actively exploited in the wild. F5's warning language and the BleepingComputer report confirm real-world exploitation.
• Expect CISA KEV inclusion. Given confirmed exploitation of an edge device from a major vendor, watch the CISA Known Exploited Vulnerabilities catalog — federal civilian agencies will face a binding remediation deadline if added, and private-sector teams should treat a KEV listing as their own de facto deadline.
• Scanning pressure is near-certain. Even organizations not yet hit should assume their appliances have been fingerprinted within hours of disclosure.

Detection & Response

The uncomfortable truth: BIG-IP appliances generate weak native telemetry for post-exploitation activity, and most organizations don't forward it to their SIEM. If you take one thing from this article, it's this — forward BIG-IP syslog (remote syslog via high-speed logging) to your SIEM today, and treat the appliance as a forensic evidence source, not a black box.

Key observable behaviors to hunt across BIG-IP and downstream telemetry:

• Unexpected tmsh execution or shell commands in audit logs (/var/log/audit, remote syslog) outside change windows
• HTTP daemon (httpd) or APM-related processes spawning shells (/bin/bash, /bin/sh) or system utilities (curl, wget, base64, python, perl)
• New or modified files under web-served and temp paths
• Configuration utility access from untrusted source IPs
• Egress connections from the BIG-IP management/self IPs to the internet (appliances should almost never initiate outbound internet sessions)

Sigma Rules

These rules assume BIG-IP syslog/audit logs are ingested into your SIEM (via CEF/syslog forwarder, Logstash, or equivalent) and normalized. Tune field names to your pipeline. I deliberately scoped these to behaviors that are anomalous on a healthy BIG-IP — they should not fire during normal operation.

---
title: BIG-IP Shell or Utility Execution Outside Administrative Context
id: 3f8a1c92-7e5b-4d2a-9f14-6c8e2b5a9104
status: experimental
description: Detects execution of shells, downloaders, or scripting interpreters on F5 BIG-IP appliances consistent with post-exploitation after unauthenticated RCE. Scoped to commands not launched by interactive admin sessions.
references:
  - https://www.bleepingcomputer.com/news/security/f5-warns-of-big-ip-apm-remote-code-execution-zero-day-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1059/004/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  product: linux
  service: auditd
detection:
  selection_cmd:
    CommandLine|contains:
      - '/bin/bash'
      - '/bin/sh'
      - 'curl '
      - 'wget '
      - 'base64 -d'
      - 'python'
      - 'perl '
      - 'nc '
      - 'ncat '
  selection_host:
    Hostname|contains:
      - 'bigip'
      - 'f5'
  condition: selection_cmd and selection_host
falsepositives:
  - Legitimate F5 support iHealth diagnostic scripts run by administrators
  - Approved automation (Ansible) tasks against the appliance
level: high
---
title: BIG-IP Audit Log Indicating Suspicious tmsh Configuration Change
id: 9c2e7a41-3b6d-4f18-a5c7-1e9d4b8f2063
status: experimental
description: Detects tmsh commands on BIG-IP appliances associated with user creation, persistence, or log tampering — common post-exploitation actions following edge device compromise.
references:
  - https://www.bleepingcomputer.com/news/security/f5-warns-of-big-ip-apm-remote-code-execution-zero-day-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1136/
  - https://attack.mitre.org/techniques/T1070/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1136
  - attack.defense_evasion
  - attack.t1070
logsource:
  product: linux
  service: syslog
detection:
  selection:
    Message|contains:
      - 'create auth user'
      - 'modify auth user'
      - 'tmsh modify sys db'
      - 'create ltm virtual'
      - 'tmsh save sys config'
      - 'rm -f /var/log'
      - 'history -c'
  condition: selection
falsepositives:
  - Documented administrative change windows — correlate against change tickets
level: high
---
title: Web or Temp Directory File Creation on Edge Appliance
id: 5d1b8e73-2c4f-4a91-b6e2-8f3c7d5a1290
status: experimental
description: Detects file writes to commonly abused web-served or temporary directories on Linux edge devices, consistent with web shell deployment following BIG-IP exploitation.
references:
  - https://www.bleepingcomputer.com/news/security/f5-warns-of-big-ip-apm-remote-code-execution-zero-day-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/var/tmp/'
      - '/shared/tmp/'
      - '/var/usr/rest/'
      - '/var/log/'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.php'
      - '.pl'
      - '.py'
      - '.sh'
  condition: selection_path and selection_ext
falsepositives:
  - F5 software installation/hotfix operations writing scripts during patching
level: medium

KQL — Microsoft Sentinel Hunt

BIG-IP telemetry typically reaches Sentinel via CEF over syslog (AMA/Linux agent into CommonSecurityLog) or as raw Syslog. This query hunts for post-exploitation command artifacts and web shell indicators in BIG-IP syslog, plus anomalous outbound connections from the appliance. Run it across the last 30 days minimum — exploitation may predate disclosure.

// Hunt BIG-IP post-exploitation: suspicious commands, web shells, config tampering
let lookback = 30d;
let suspicious_terms = dynamic(["/bin/bash", "/bin/sh", "curl ", "wget ", "base64 -d", "python", "perl ", "nc -", "ncat", "create auth user", "modify auth user", "/var/tmp/", "/shared/tmp/", "history -c", "rm -f /var/log"]);
let bigip_syslog =
    Syslog
    | where TimeGenerated > ago(lookback)
    | where Computer has_any ("bigip", "f5") or HostName has_any ("bigip", "f5")
    | extend Msg = tostring(SyslogMessage)
    | project TimeGenerated, Computer, Facility, SeverityLevel, ProcessName, Msg;
let bigip_cef =
    CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where DeviceVendor =~ "F5"
    | extend Msg = coalesce(tostring(Message), tostring(AdditionalExtensions))
    | project TimeGenerated, SourceIP, DestinationIP, DeviceProduct, Msg;
union bigip_syslog, bigip_cef
| where Msg has_any (suspicious_terms)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count() by Computer, ProcessName, Msg
| order by LastSeen desc;
// Companion hunt: BIG-IP appliance initiating outbound internet connections (highly anomalous)
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor =~ "F5"
| where ipv4_is_private(SourceIP) and not(ipv4_is_private(DestinationIP))
| where DestinationPort !in (53, 123, 443)  // exclude expected DNS/NTP/phone-home — tune to your baseline
| summarize Connections = count(), Ports = make_set(DestinationPort), DestIPs = make_set(DestinationIP) by SourceIP
| order by Connections desc;

Velociraptor VQL — Appliance and Downstream Hunt

Velociraptor doesn't deploy to the BIG-IP itself, but it's invaluable for the second phase: hunting downstream internal hosts for lateral movement originating from the appliance's network position, and — where you have an SSH collector workflow — validating artifacts on the appliance via a jump host. This artifact hunts endpoints for processes and network connections referencing the BIG-IP's IP addresses, catching pivot activity.

-- Hunt for lateral movement artifacts tied to BIG-IP appliance IPs
-- Populate $bigip_ips with your appliance self/management IPs before deployment
LET bigip_ips <= ('10.0.0.5', '10.0.0.6')

SELECT Pid,
       Name,
       CommandLine,
       Exe,
       Username,
       CreateTime
FROM pslist()
WHERE CommandLine =~ '10\\.0\\.0\\.(5|6)'
   OR Exe =~ '(?i)(powershell|cmd|wmic|psexec|winrm)'

-- Companion: enumerate active connections to/from BIG-IP addresses
LET conns = SELECT Laddr.IP AS LocalIP,
       Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP,
       Raddr.Port AS RemotePort,
       Status,
       Pid
FROM netstat()

SELECT LocalIP, LocalPort, RemoteIP, RemotePort, Status, Pid
FROM conns
WHERE RemoteIP =~ '10\\.0\\.0\\.(5|6)'
   AND RemotePort NOT IN (443, 80)

Remediation Script

The following Bash script is designed to run directly on the BIG-IP via SSH (advanced shell) to assess exposure, capture compromise indicators for evidence, and verify version. Run read-only checks first; do not reboot or modify configuration before capturing evidence if you suspect compromise.

#!/bin/bash
# BIG-IP APM RCE — Emergency Assessment & Evidence Capture Script
# Run on the appliance via advanced shell (bash). Requires root.
# SECURITY ARSENAL — Read-only by design. Review before execution.

TS=$(date +%Y%m%d-%H%M%S)
OUTDIR="/shared/tmp/bigip-ir-${TS}"
mkdir -p "${OUTDIR}"

echo "[+] 1. Current software version (compare against F5 advisory fixed builds)"
tmsh show sys version | tee "${OUTDIR}/sys-version.txt"

echo "[+] 2. Provisioned modules — confirm whether APM is active"
tmsh list sys provision | tee "${OUTDIR}/provision.txt"

echo "[+] 3. Management interface exposure check — list self IPs and port lockdown"
tmsh list net self | tee "${OUTDIR}/self-ips.txt"
tmsh list sys management-ip | tee "${OUTDIR}/mgmt-ip.txt"

echo "[+] 4. Local user accounts — look for unexpected accounts (persistence)"
tmsh list auth user | tee "${OUTDIR}/auth-users.txt"

echo "[+] 5. Recent audit log activity — flag tmsh changes outside change windows"
grep -E "create auth user|modify auth user|save sys config" /var/log/audit 2>/dev/null \
  | tail -n 200 | tee "${OUTDIR}/audit-flagged.txt"

echo "[+] 6. Suspicious files in common web shell landing zones"
find /var/tmp /shared/tmp /var/usr/rest -type f \
  \( -name "*.jsp" -o -name "*.php" -o -name "*.pl" -o -name "*.py" -o -name "*.sh" \) \
  -newermt "30 days ago" -exec ls -la {} \; 2>/dev/null | tee "${OUTDIR}/suspicious-files.txt"

echo "[+] 7. Processes — shells or interpreters parented by httpd/java (exploitation signature)"
ps auxf | tee "${OUTDIR}/process-tree.txt" >/dev/null
ps auxf | grep -E "httpd|java" -A3 | grep -E "/bin/(ba)?sh|python|perl" | tee "${OUTDIR}/shell-children.txt"

echo "[+] 8. Network connections — outbound sessions from appliance (highly anomalous)"
netstat -antp 2>/dev/null | grep ESTABLISHED | tee "${OUTDIR}/netstat.txt"

echo "[+] 9. Remote syslog forwarding configured? (telemetry gap check)"
tmsh list sys syslog | tee "${OUTDIR}/syslog-config.txt"

echo ""
echo "[+] Evidence bundle: ${OUTDIR}"
echo "[+] NEXT STEPS:"
echo "    1. Copy ${OUTDIR} off-box to a forensic workstation (scp)"
echo "    2. Apply F5 hotfix per advisory for your release train"
echo "    3. If indicators of compromise found: treat as IR engagement — rotate ALL"
echo "       credentials stored on/transiting the appliance (AD bind, LDAP, certs, keys)"

Remediation

Execute these steps in order. Do not skip evidence capture if your appliance was internet-exposed — patching first destroys forensic artifacts you will need to answer the question "were we already hit?"

1. Identify exposure immediately. Inventory every BIG-IP appliance with APM provisioned. Determine whether APM virtual servers or the management interface are reachable from the internet or untrusted segments. The management interface (Configuration utility, TCP 443/8443 on the mgmt address) must never be internet-facing — if yours is, restrict it via self-IP port lockdown and network ACLs as an emergency measure even before patching.
2. Capture evidence using the script above (or your own triage process) on every exposed appliance. Preserve /var/log/audit, /var/log/ltm, /var/log/apm, and process/network state.
3. Apply the F5 hotfix for your specific release train as published in F5's security advisory (retrieve from F5 Security Advisories / MyF5 — search for the current APM RCE advisory ID; F5 publishes per-train fixed builds). Do not assume "latest version" means "fixed" — verify the build number against the advisory table.
4. Hunt retroactively. Run the Sigma, KQL, and VQL content above across at least the last 30 days. Exploitation of edge devices routinely precedes public disclosure.
5. If compromise is confirmed or suspected:
   • Rotate every credential the appliance holds or transits: AD/LDAP bind accounts, service accounts, local admin accounts, API tokens, TLS private keys, and any SSO/IdP integration secrets (APM's SAML/OAuth trust material).
   • Rebuild rather than clean if you have any doubt — restoring a known-good UCS archive onto patched software is more defensible than surgically removing artifacts from a live compromised system.
   • Engage IR support; edge device compromises frequently precede deeper intrusions.
6. Fix the telemetry gap. Configure remote syslog forwarding (tmsh modify sys syslog remote-servers add {...}) to your SIEM, and enable audit logging for all tmsh and GUI configuration changes. Monitor for configuration drift.
7. Watch CISA KEV. If this CVE is added to the Known Exploited Vulnerabilities catalog, federal agencies face a binding BOD 22-01 deadline — and your organization should adopt that same date internally.
8. Longer term: Put edge devices in your vulnerability management SLA at the same tier as domain controllers. A critical, exploited, unauthenticated RCE on an internet-facing appliance should carry a 24–72 hour patch SLA, not a 30-day cycle.

Edge devices are where intrusions start in 2026. The organizations that come out of these events intact are the ones that patch in hours, hunt before they patch, and have telemetry off the box before the attacker arrives.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub