Posted on

F5 BIG-IP APM CVE-2026-94127 – Actively Exploited OAuth Authorization Server RCE

Threat Overview

F5 disclosed CVE-2026-94127 on September 22, 2026, with September 23 reporting confirming zero-day exploitation. The heap-based buffer overflow affects BIG-IP APM virtual servers operating as OAuth Authorization Servers. Specific unauthenticated traffic to the data-plane virtual server can cause remote code execution. Appliance mode is also vulnerable. CISA added the flaw to KEV on September 22.

References

Impacted Systems

BIG-IP APM OAuth Authorization Server: 21.1.0 before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG; 17.5.0 through 17.5.1 before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG; 17.1.0 through 17.1.3 before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. OAuth Client/Resource Server-only deployments are not affected. End-of-Technical-Support versions were not evaluated.

Why this matters

BIG-IP APM commonly sits directly in the application access path. Pre-authentication code execution on an Internet-facing access gateway can provide a high-value initial foothold before authentication controls are reached.

Exploitation Status

Confirmed active exploitation. F5 states the vulnerability has been exploited, and CISA added CVE-2026-94127 to KEV. Public reporting does not identify the attacker, victim count, or campaign scale.

What this hunt looks for

Repeated failed OAuth UserInfo activity, TMM/SOD crash behavior, suspicious BIG-IP audit commands, unusual OAuth endpoint sources, and network activity around the affected virtual server.

Required logs

BIG-IP APM/Syslog and surrounding network or reverse-proxy telemetry in CommonSecurityLog where available.

First Pass – Repeated Invalid OAuth Tokens

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has "The access token is invalid"
| summarize Failures=count(),FirstSeen=min(TimeGenerated),LastSeen=max(TimeGenerated) by Computer,HostName,bin(TimeGenerated,5m)
| where Failures >= 10
| order by Failures desc

OAuth UserInfo Failures

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("UserInfo","userinfo")
| where SyslogMessage has_any ("access token is invalid","invalid token","failed")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

TMM and SOD Crash Indicators

Syslog
| where TimeGenerated >= ago(30d)
| where ProcessName has_any ("tmm","sod") or SyslogMessage has_any ("TMM","SOD")
| where SyslogMessage has_any ("SIGABRT","core","abort","restart","crash")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Suspicious BIG-IP Audit Commands

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("audit","tmsh","bash","sh -c","curl ","wget ","python ","perl ")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

OAuth Failure and Crash Correlation

let F=Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has "The access token is invalid"
| summarize Failures=count() by Computer,bin(TimeGenerated,10m)
| where Failures >= 10;
let C=Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("SIGABRT","TMM","core")
| summarize Crashes=count() by Computer,bin(TimeGenerated,10m);
F
| join kind=inner C on Computer,TimeGenerated
| order by TimeGenerated desc

OAuth Endpoint Network Activity

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has_any ("oauth","userinfo","token")
| project TimeGenerated,SourceIP,DestinationIP,DestinationPort,RequestMethod,RequestURL,DeviceAction,Message
| order by TimeGenerated desc

New OAuth Endpoint Sources

let Known=CommonSecurityLog
| where TimeGenerated between (ago(30d)..ago(2d))
| where RequestURL has_any ("oauth","userinfo","token")
| summarize by SourceIP,DestinationIP;
CommonSecurityLog
| where TimeGenerated >= ago(2d)
| where RequestURL has_any ("oauth","userinfo","token")
| join kind=leftanti Known on SourceIP,DestinationIP
| project TimeGenerated,SourceIP,DestinationIP,RequestURL,DeviceAction
| order by TimeGenerated desc

BIG-IP Network Activity

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceVendor has "F5" or DeviceProduct has "BIG-IP"
| project TimeGenerated,SourceIP,DestinationIP,SourcePort,DestinationPort,Protocol,DeviceAction,Message
| order by TimeGenerated desc

Detection Notes

F5’s strongest published compromise pattern is repeated failed UserInfo requests containing ‘The access token is invalid’, suspicious commands near those failures, and a TMM SIGABRT shortly afterward. TMM core files alone are not proof. Direct visibility requires BIG-IP/APM or surrounding network telemetry.

Leave a comment