CVE-2026-94127: F5 BIG-IP APM Heap Overflow Actively Exploited via OAuth Authorization Server Configuration

Summary

On September 22, 2026, F5 published advisory K000162605 disclosing CVE-2026-94127, a heap-based buffer overflow (CWE-122) in BIG-IP Access Policy Manager that permits unauthenticated remote code execution [1][2]. F5 confirmed exploitation in the wild with the statement: "We have learned that this vulnerability has been exploited" [1]. The vulnerability carries a CVSS v3.1 base score of 9.8 [2][9]. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day under Binding Operational Directive 22-01 and set a September 25 remediation deadline for Federal Civilian Executive Branch agencies [6][11]. No public proof-of-concept exploit has been confirmed as of this writing [10].

Shadowserver currently tracks over 14,700 IP addresses with BIG-IP APM fingerprints as of the advisory publication date, though the proportion that are patched or are honeypots is unknown [1]. CERT-EU issued Advisory 2026-013 [3], and the Canadian Centre for Cyber Security published AL26-022 and AV26-949 [4], both corroborating active exploitation and recommending immediate action.

Background: BIG-IP APM and F5's Exploitation History

BIG-IP APM is F5's centralized access management proxy. It controls how users reach applications, APIs, VPN services, and cloud resources [1][8]. Organizations commonly deploy it as an authentication gateway for OAuth-based authentication, single sign-on, and federated identity services [8]. APM can integrate with OAuth, OpenID Connect, and SAML [10].

F5 edge devices have a documented history of exploitation by both cybercriminal and state-sponsored groups. Past campaigns have used F5 vulnerabilities to breach networks, hijack devices, map internal servers, deploy data-wiping malware, and steal sensitive documents [1]. Another APM vulnerability was reportedly added to CISA's KEV catalog earlier in 2026 [2]. The fixed builds for that vulnerability may still fall within the affected range for CVE-2026-94127, meaning systems patched for the earlier flaw likely still require this new hotfix [2]. Defenders who treated a previous patch cycle as complete coverage for their BIG-IP APM fleet should reassess.

Root Cause

CVE-2026-94127 is a heap-based buffer overflow in the Traffic Management Microkernel (TMM), the BIG-IP data plane process that handles client traffic [7]. The defect is in the OAuth profile handling logic: attacker-influenced data is written into a heap allocation without proper input size validation, overrunning the allocation and corrupting adjacent heap memory [7]. According to community analysis, an attacker who controls the contents of the corrupted region could alter control flow inside TMM, converting the memory corruption into arbitrary code execution [7].

Trigger Conditions

The vulnerability triggers only on virtual servers that have both an APM access policy and an OAuth profile configured, with APM acting as an OAuth Authorization Server [1][2]. Deployments using APM strictly as an OAuth Client or Resource Server are not affected [2]. In F5's configuration guide for APM 17.1, 17.5, and 21.0, the OAuth profile is created under Access > Federation > OAuth Authorization Server > OAuth Profile [2].

Attack Surface Clarification

This is a data plane issue. The malicious traffic targets the virtual server directly, not the BIG-IP management interface [2][5][7]. F5 states explicitly: "Because the malicious traffic goes to the virtual server itself, limiting access to the BIG-IP management interface does not protect against this flaw" [2]. BIG-IP systems operating in Appliance mode, a hardened configuration that restricts administrative access, are also vulnerable [2][5][7]. Appliance mode restricts administrative operations, not data plane traffic handling [7].

Affected Versions and Hotfixes

Note: Verify exact hotfix filenames against F5 advisory K000162605, as filenames may be updated.

End of Technical Support software versions were not evaluated by F5 [F5 Advisory K000162605].

Indicators of Compromise

F5 and CERT-EU provide a behavioral IoC pattern rather than static file hashes or network indicators [1][3]. The sequence to detect is:

1. Repeated OAuth authentication failures: Check /var/log/apm for repeated failures from a single IP address in a short time window [3][5].
2. Suspicious command activity: Review /var/log/audit for unexpected commands following the authentication failure burst [5].
3. TMM SIGABRT: A TMM crash signal following the above two stages completes the exploitation chain indicator [1][3].

The individual components in isolation are insufficient. The three-stage sequence (failure burst, then suspicious commands, then TMM crash) is the combination F5 says should trigger human review [1][3]. Additionally, tmctl global_oauth_stat counters may reveal anomalous OAuth activity [5].

F5's advisory and CISA's KEV entry do not disclose attacker identity, the number of compromised systems, or the targeted organizations [2].

MITRE ATT&CK Mapping

Based on the described exploitation behavior and TMM compromise:

Log-Based Detection

Build a correlation rule in your SIEM that identifies the three-stage exploitation sequence within a defined time window (F5 does not specify exact timing, but a 5-to-15-minute window is a reasonable starting point):

1. Multiple OAuth authentication failure log entries in /var/log/apm from a single source IP (a threshold of 10 or more is suggested as a starting detection baseline) [3]
2. Followed by command execution entries in /var/log/audit [5]
3. Followed by a TMM SIGABRT signal [1]

Sigma Rule

title: F5 BIG-IP APM CVE-2026-94127 Exploitation Sequence
id: a7c3e1f2-8b94-4d6e-b1a3-9f2d4c7e5a18
status: experimental
author: RedSheepSec
date: 2026/09/23
description: Detects the behavioral IoC pattern described by F5 for CVE-2026-94127 exploitation - repeated OAuth failures followed by TMM SIGABRT
logsource:
    product: f5_bigip
    service: apm
detection:
    oauth_failures:
        log_path: '/var/log/apm'
        # Verify exact message ID against your BIG-IP version's logging format
        message|contains: 'OAuth'
    tmm_crash:
        message|contains: 'SIGABRT'
    condition: oauth_failures | count() by src_ip > 9 and tmm_crash
falsepositives:
    - Legitimate OAuth misconfigurations generating high failure rates combined with unrelated TMM crashes
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.94127

Note: The exact F5 APM log message ID for OAuth authentication failures should be confirmed against your deployed BIG-IP version's logging format before deploying this rule in production.

Network and Host Indicators

• Monitor for anomalous traffic volumes to BIG-IP APM virtual servers configured with OAuth Authorization Server profiles. The attack vector is through client-facing traffic, not the management interface [2][7].
• Review tmctl global_oauth_stat counters for unexpected spikes in OAuth-related processing [5].
• Audit administrative accounts and access policies on BIG-IP appliances for unauthorized modifications, as recommended by the Canadian Centre for Cyber Security [4].
• Restrict management interfaces to trusted networks as a defense-in-depth measure, recognizing this does not mitigate CVE-2026-94127 itself [4].

Mitigation

For organizations that cannot apply hotfixes immediately, F5 provides an iRule-based mitigation for the affected virtual server [1][3]. This iRule is not publicly posted. Customers must contact F5 Support with an active support contract to obtain it [5]. CISA's KEV entry directs agencies to apply mitigations per vendor instructions by the September 25 deadline [11].

CERT-EU and multiple sources strongly recommend preserving forensic evidence before applying hotfixes, because patching and restarting can alter volatile evidence needed to determine whether prior exploitation occurred [3][9]. Capture /var/log/apm, /var/log/audit, core dumps, and configuration snapshots before applying any changes.

Broader Context: Edge Device Exploitation Trend

CISA did not add CVE-2026-94127 alone on September 22. The same KEV update included three additional vulnerabilities: CVE-2026-85102 and CVE-2026-93616 (Check Point) and CVE-2026-93952 (Arista VeloCloud Orchestrator) [11]. CISA's guidance associated with these KEV entries emphasized applying vendor mitigations promptly [11].

This pattern of multiple network infrastructure and security device vulnerabilities appearing under active exploitation in a single KEV update reflects a sustained operational focus by threat actors on network perimeter infrastructure throughout 2026 [6].

Analysis

The operational significance of CVE-2026-94127 comes from the intersection of several factors: the vulnerability sits in the data plane (not the management plane), the affected configuration is common in enterprise SSO and federated identity deployments [8], and the device class occupies a position in network architecture where compromise provides direct access to authentication flows. The three-day CISA remediation window from September 22 to September 25 is unusually compressed, reflecting the assessed severity.

The absence of a public PoC as of September 22 [10] does not reduce the urgency. F5 confirmed exploitation before disclosure, meaning at least one threat actor already possesses a working exploit. The 14,700+ internet-visible BIG-IP APM instances tracked by Shadowserver [1] represent a substantial attack surface, and the configuration-dependent trigger condition means defenders must audit their specific deployments rather than assuming they are unaffected.

The emphasis on forensic triage in guidance from CERT-EU [3] and the Canadian Centre for Cyber Security [4] reflects growing recognition that for zero-day exploitation, patching alone is insufficient to address potential existing compromise. Organizations should consider incorporating pre-patch forensic evidence preservation as standard procedure for actively exploited vulnerabilities.

References

[1] https://www.bleepingcomputer.com/news/security/f5-warns-of-big-ip-apm-remote-code-execution-zero-day-exploited-in-attacks/

[2] https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html

[3] https://cert.europa.eu/publications/security-advisories/2026-013/

[4] https://www.cyber.gc.ca/en/alerts-advisories/al26-022-vulnerability-impacting-f5-big-ip-access-policy-manager-apm-cve-2026-94127

[5] https://windowsforum.com/news/cve-2026-94127-f5-big-ip-apm-hotfixes-for-actively-exploited-oauth-rce.445557/

[6] https://shattered.io/f5-big-ip-zero-day-cve-2026-94127-2026/

[7] https://dev.to/jeffreyciend/cve-2026-94127-what-f5-big-ip-operators-need-to-know-about-the-exploited-apm-flaw-hpi

[8] https://fieldeffect.com/blog/f5-fixes-big-ip-apm-vulnerability

[9] https://socprime.com/blog/cve-2026-94127-analysis/

[10] https://rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm/

[11] https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog

Event Timeline

Entity Relationships

Diamond Model

Hunt Guide: CVE-2026-94127 F5 BIG-IP APM Heap Overflow Exploitation via OAuth Authorization Server Configuration

Attribution: Rules adapted, ported, or quoted from a public source retain that source's author (e.g. SigmaHQ / Florian Roth, Elastic, Emerging Threats, Abuse.ch, or the cited vendor/researcher) and carry an attribution credit. Rules without a credit were authored in-house by RedSheepSec. If you reuse a rule, preserve its stated attribution.

Hypothesis: If threat actors are exploiting CVE-2026-94127 against BIG-IP APM instances in our environment, we expect to observe repeated OAuth authentication failures from single source IPs followed by anomalous command execution and TMM crash events in F5 appliance logs, as well as anomalous traffic patterns against BIG-IP APM virtual servers with OAuth Authorization Server profiles in network telemetry.

Intelligence Summary: On September 22, 2026, F5 disclosed CVE-2026-94127, a CVSS 9.8 heap-based buffer overflow in the Traffic Management Microkernel (TMM) of BIG-IP Access Policy Manager that permits unauthenticated remote code execution against virtual servers configured with both an APM access policy and an OAuth Authorization Server profile. F5 confirmed active exploitation in the wild prior to disclosure, and CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day with a three-day remediation deadline. The vulnerability is a data-plane issue, meaning restricting access to the BIG-IP management interface does not mitigate it, and systems running in Appliance mode are also vulnerable.

Confidence: Moderate | Priority: Critical

Scope

• Networks: All network segments hosting F5 BIG-IP APM virtual servers, with emphasis on internet-facing DMZ segments. Include internal segments where BIG-IP APM provides SSO or federated identity services. Review both external-facing and internal virtual servers since some APM deployments serve internal OAuth authorization.
• Timeframe: September 1, 2026 through present. F5 confirmed exploitation prior to the September 22 disclosure, and CERT-EU guidance suggests the exploitation timeline may extend weeks or months before disclosure. A 30-day lookback is the minimum recommended window; 90 days is preferable if log retention supports it.
• Priority Systems: F5 BIG-IP APM instances configured with both an APM access policy and an OAuth Authorization Server profile (Access > Federation > OAuth Authorization Server > OAuth Profile). Prioritize internet-facing virtual servers running affected versions: 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0. Also prioritize systems that handle authentication for clinical applications, EHR systems, or VPN services.

MITRE ATT&CK Techniques

T1190: Exploit Public-Facing Application (Initial Access) [P2]

CVE-2026-94127 is an unauthenticated heap-based buffer overflow in the BIG-IP TMM process triggered through OAuth profile handling on internet-facing virtual servers. Attacker-controlled data overruns a heap allocation in TMM, corrupting adjacent memory and enabling arbitrary code execution. The attack targets the data plane directly via client-facing traffic to the virtual server, not the management interface. The behavioral exploitation chain involves repeated OAuth authentication failures, followed by suspicious command execution, then a TMM SIGABRT crash signal.

Splunk SPL:

index=corelight sourcetype=corelight_http (uri="*oauth*" OR uri="*authorize*" OR uri="*token*") 
| stats count dc(uri) as unique_uris values(uri) as uris by id.orig_h id.resp_h id.resp_p 
| where count > 50 
| sort -count 
| table id.orig_h id.resp_h id.resp_p count unique_uris uris 
`comment("Detects high-volume OAuth-related HTTP requests to potential BIG-IP APM virtual servers. Tune threshold based on baseline. P2 behavioral detection.")`

Elastic KQL:

event.dataset:"corelight.http" AND (url.path:*oauth* OR url.path:*authorize* OR url.path:*token*) | Stats by source.ip, destination.ip, destination.port showing high request volumes indicating potential exploitation attempts

Sigma Rule:

title: High Volume OAuth Requests to Potential BIG-IP APM Virtual Server
id: b8d4f2a1-7c93-4e5b-a2d6-1e3f5b8c9d72
status: experimental
author: RedSheepSec
date: 2026/09/23
description: Detects an unusually high volume of OAuth-related HTTP requests from a single source IP to a destination, which may indicate exploitation attempts against CVE-2026-94127 in F5 BIG-IP APM.
logsource:
    category: proxy
    # Also applicable to network monitoring logs such as Zeek/Corelight HTTP
detection:
    selection:
        cs-uri-query|contains:
            - 'oauth'
            - 'authorize'
            - 'token'
            - 'OAuth'
    condition: selection | count() by src_ip > 50
falsepositives:
    - Legitimate high-volume OAuth integrations or automated health checks
    - Load testing against OAuth endpoints
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.94127

This is a broad behavioral detection. Refine the destination IP or port fields to match known BIG-IP APM virtual server addresses in your environment. The threshold of 50 requests is a starting point; adjust based on normal OAuth traffic volume. Pair with F5 appliance-side log analysis for the full three-stage exploitation chain.

T1190: Exploit Public-Facing Application (Initial Access) [P1]

Detection of the three-stage exploitation behavioral IoC chain described by F5 and CERT-EU: (1) repeated OAuth authentication failures from a single source IP in /var/log/apm, (2) suspicious command execution in /var/log/audit, (3) TMM SIGABRT crash. This hunt targets F5 syslog data forwarded to Splunk.

Splunk SPL:

index=firewall OR index=main sourcetype=syslog ("OAuth" AND ("fail" OR "error" OR "denied" OR "invalid"))
| stats count as oauth_failures earliest(_time) as first_failure latest(_time) as last_failure by host src_ip
| where oauth_failures > 9
| join type=inner host 
    [search index=firewall OR index=main sourcetype=syslog ("audit" AND ("cmd" OR "command" OR "exec" OR "shell" OR "bash" OR "tmsh"))
    | stats count as cmd_count earliest(_time) as first_cmd latest(_time) as last_cmd by host]
| join type=inner host 
    [search index=firewall OR index=main sourcetype=syslog "SIGABRT" 
    | stats count as crash_count earliest(_time) as crash_time by host]
| where first_cmd > first_failure AND crash_time > first_cmd
| eval time_window_min=round((crash_time - first_failure)/60, 1)
| where time_window_min <= 15
| table host src_ip oauth_failures first_failure last_failure cmd_count first_cmd crash_count crash_time time_window_min
`comment("Three-stage CVE-2026-94127 exploitation chain: OAuth failures -> suspicious commands -> TMM SIGABRT within 15 minutes. P1 detection. Requires F5 syslog forwarded to Splunk.")`

Elastic KQL:

(message:"OAuth" AND (message:"fail" OR message:"error" OR message:"denied")) OR (message:"audit" AND (message:"cmd" OR message:"exec" OR message:"shell")) OR message:"SIGABRT"

Sigma Rule:

title: F5 BIG-IP APM CVE-2026-94127 Three-Stage Exploitation Chain
id: a7c3e1f2-8b94-4d6e-b1a3-9f2d4c7e5a18
status: experimental
author: RedSheepSec
date: 2026/09/23
description: Detects the behavioral IoC pattern described by F5 and CERT-EU for CVE-2026-94127 exploitation. The three-stage sequence is repeated OAuth authentication failures from a single source IP, followed by suspicious command activity, followed by a TMM SIGABRT crash signal. Each individual component in isolation may be benign; the correlation of all three within a short time window is the indicator.
references:
    - https://my.f5.com/manage/s/article/K000162605
    - https://cert.europa.eu/publications/security-advisories/2026-013/
logsource:
    product: f5_bigip
    service: syslog
detection:
    oauth_failures:
        message|contains|all:
            - 'OAuth'
        message|contains:
            - 'fail'
            - 'error'
            - 'denied'
            - 'invalid'
    suspicious_commands:
        message|contains:
            - 'cmd'
            - 'exec'
            - 'shell'
            - 'bash'
            - 'tmsh'
    tmm_crash:
        message|contains: 'SIGABRT'
    condition: oauth_failures | count() by src_ip > 9 and suspicious_commands and tmm_crash
falsepositives:
    - Legitimate OAuth misconfigurations generating high failure rates combined with unrelated TMM crashes
    - Administrative tmsh commands during routine maintenance coinciding with OAuth errors
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.94127

This detection requires F5 BIG-IP syslog data forwarded to your SIEM. The exact log message format for OAuth authentication failures varies by BIG-IP version; confirm the specific message strings against your deployed version before production deployment. The 15-minute correlation window and threshold of 10 failures are starting baselines per CERT-EU guidance. If your environment does not forward BIG-IP logs to Splunk, this is a critical gap that must be addressed.

T1059.004: Unix Shell (Execution) [P1]

Post-exploitation command execution on compromised BIG-IP appliances. F5 and CERT-EU note that suspicious commands in /var/log/audit following the OAuth failure burst constitute stage two of the exploitation chain. BIG-IP runs a Linux-based OS, making Unix shell (T1059.004) the likely interpreter for post-exploitation activity, though specific command details have not been publicly disclosed.

Splunk SPL:

index=firewall OR index=main sourcetype=syslog host="*bigip*" OR host="*f5*" ("audit" OR source="/var/log/audit")
| eval is_suspicious=if(match(_raw, "(?i)(wget|curl|nc |ncat|python|perl|bash -[ic]|chmod|chown|/tmp/|/dev/shm|base64|eval|crontab|useradd|passwd|ssh-keygen|id_rsa)"), 1, 0)
| where is_suspicious=1
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(_raw) as raw_events by host src_ip
| sort -count
| table host src_ip count first_seen last_seen raw_events
`comment("Detects suspicious post-exploitation commands in F5 BIG-IP audit logs. P1 detection for CVE-2026-94127 stage 2. Requires BIG-IP syslog forwarding.")`

Elastic KQL:

(host.name:*bigip* OR host.name:*f5*) AND (message:"audit" OR log.file.path:"/var/log/audit") AND (message:"wget" OR message:"curl" OR message:"python" OR message:"bash" OR message:"base64" OR message:"/tmp/" OR message:"/dev/shm" OR message:"chmod" OR message:"useradd" OR message:"crontab")

Sigma Rule:

title: Suspicious Post-Exploitation Commands on F5 BIG-IP Appliance
id: c9e5d3a7-1f82-4b6d-9c3e-7a4d2f8b1e56
status: experimental
author: RedSheepSec
date: 2026/09/23
description: Detects commands commonly associated with post-exploitation activity in F5 BIG-IP audit logs, corresponding to stage two of the CVE-2026-94127 exploitation chain.
logsource:
    product: f5_bigip
    service: audit
detection:
    selection:
        message|contains:
            - 'wget'
            - 'curl'
            - '/tmp/'
            - '/dev/shm'
            - 'base64'
            - 'chmod'
            - 'useradd'
            - 'crontab'
            - 'ssh-keygen'
            - 'id_rsa'
            - 'python'
            - 'perl'
            - 'nc '
    condition: selection
falsepositives:
    - Legitimate administrative activity using tmsh or bash on BIG-IP
    - Automated configuration management scripts
level: high
tags:
    - attack.execution
    - attack.t1059.004
    - cve.2026.94127

This detection will generate false positives from legitimate administrative activity on BIG-IP appliances. Correlate hits with stage one (OAuth failure burst) and stage three (TMM SIGABRT) to increase confidence. Baseline normal administrative commands on your BIG-IP fleet and exclude known maintenance windows or automation accounts.

Indicators of Compromise

IOC Sweep Queries (Splunk):

index=firewall OR index=main sourcetype=syslog (source="/var/log/apm" OR _raw="*/var/log/apm*") ("OAuth" AND ("fail" OR "error" OR "denied"))
| stats count by host src_ip _time
| where count > 9
| table host src_ip count _time

index=firewall OR index=main sourcetype=syslog (source="/var/log/audit" OR _raw="*/var/log/audit*") host="*bigip*" OR host="*f5*"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by host src_ip
| sort -count
| table host src_ip count first_seen last_seen

index=crowdstrike sourcetype="crowdstrike:events:sensor" OR index=linux-server
| search "Hotfix-BIGIP-21.1.0.2.0.30.22-ENG"
| stats count by host _time
| table host count _time

index=crowdstrike sourcetype="crowdstrike:events:sensor" OR index=linux-server
| search "Hotfix-BIGIP-17.5.1.9.0.160.12-ENG"
| stats count by host _time
| table host count _time

index=crowdstrike sourcetype="crowdstrike:events:sensor" OR index=linux-server
| search "Hotfix-BIGIP-17.1.3.5.0.41.14-ENG"
| stats count by host _time
| table host count _time

index=corelight sourcetype=corelight_http host_header="my.f5.com" uri="*K000162605*"
| stats count by id.orig_h id.resp_h _time
| table id.orig_h id.resp_h count _time
`comment("Identifies hosts accessing the F5 advisory, useful for verifying patch awareness")`

YARA Rules

F5_BIGIP_CVE_2026_94127_PostExploit_Artifacts: Detects potential post-exploitation artifacts on F5 BIG-IP appliances related to CVE-2026-94127 exploitation, including references to the exploitation chain components. This rule targets files that may be dropped or modified during or after exploitation of the TMM heap overflow.

rule F5_BIGIP_CVE_2026_94127_PostExploit_Artifacts
{
    meta:
        author = "RedSheepSec"
        description = "Detects potential post-exploitation artifacts associated with CVE-2026-94127 F5 BIG-IP APM heap overflow exploitation"
        date = "2026-09-23"
        reference = "https://my.f5.com/manage/s/article/K000162605"
        severity = "critical"

    strings:
        $log_apm = "/var/log/apm" ascii
        $log_audit = "/var/log/audit" ascii
        $tmm_ref = "tmm" ascii
        $sigabrt = "SIGABRT" ascii
        $oauth_profile = "oauth_profile" ascii
        $oauth_server = "OAuth Authorization Server" ascii wide
        $hotfix1 = "Hotfix-BIGIP-21.1.0.2.0.30.22-ENG" ascii
        $hotfix2 = "Hotfix-BIGIP-17.5.1.9.0.160.12-ENG" ascii
        $hotfix3 = "Hotfix-BIGIP-17.1.3.5.0.41.14-ENG" ascii
        $shell1 = "/bin/bash" ascii
        $shell2 = "/bin/sh" ascii
        $tmp_exec = "/tmp/" ascii
        $shm_exec = "/dev/shm/" ascii

    condition:
        ($sigabrt and $tmm_ref) or
        ($log_apm and $log_audit and ($shell1 or $shell2)) or
        (2 of ($hotfix1, $hotfix2, $hotfix3)) or
        ($oauth_profile and ($tmp_exec or $shm_exec) and ($shell1 or $shell2))
}

Suricata Rules

SID 2026941270: Detects potential CVE-2026-94127 exploitation attempts by identifying high-frequency OAuth-related HTTP requests targeting BIG-IP APM virtual servers. The rule looks for OAuth authorization endpoint patterns in HTTP traffic.

alert http any any -> $HOME_NET any (msg:"REDSHEEPSEC Possible CVE-2026-94127 F5 BIG-IP APM OAuth Exploitation Attempt"; flow:established,to_server; http.uri; content:"/f5-oauth2/"; nocase; threshold:type both, track by_src, count 20, seconds 60; reference:cve,2026-94127; reference:url,my.f5.com/manage/s/article/K000162605; classtype:web-application-attack; sid:2026941270; rev:1; metadata:created_at 2026_09_23, updated_at 2026_09_23;)

SID 2026941271: Detects potential CVE-2026-94127 exploitation by identifying OAuth token or authorization requests with anomalously large content lengths that may indicate heap overflow payloads targeting the TMM process.

alert http any any -> $HOME_NET any (msg:"REDSHEEPSEC Possible CVE-2026-94127 Oversized OAuth Request to BIG-IP APM"; flow:established,to_server; http.uri; content:"/oauth"; nocase; http.header; content:"Content-Length"; content:!"0"; http.request_body; isdataat:8192; reference:cve,2026-94127; reference:url,my.f5.com/manage/s/article/K000162605; classtype:web-application-attack; sid:2026941271; rev:1; metadata:created_at 2026_09_23, updated_at 2026_09_23;)

Data Source Requirements

Recommendations

• Immediately identify all F5 BIG-IP APM virtual servers configured with both an APM access policy and an OAuth Authorization Server profile. Use the BIG-IP GUI path Access > Federation > OAuth Authorization Server > OAuth Profile to verify configuration on each virtual server.
• Preserve forensic evidence on all BIG-IP APM appliances before applying patches: copy /var/log/apm, /var/log/audit, any core dumps, and the running configuration. Patching and restarting can overwrite volatile artifacts needed to determine whether prior exploitation occurred.
• Apply the appropriate F5 engineering hotfix immediately: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG for 21.1.0, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG for 17.5.x, or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG for 17.1.x. Verify exact filenames against F5 advisory K000162605. If immediate patching is not feasible, contact F5 Support to obtain the iRule-based mitigation.
• Verify that systems previously patched for earlier BIG-IP APM vulnerabilities are also patched for CVE-2026-94127, as the earlier fixed builds may still fall within the affected version range for this new vulnerability.
• Deploy the three-stage exploitation chain correlation rule in Splunk to detect the behavioral IoC pattern: 10 or more OAuth authentication failures from a single source IP within 15 minutes, followed by suspicious command execution, followed by a TMM SIGABRT signal.
• Ensure F5 BIG-IP syslog forwarding is configured to send /var/log/apm and /var/log/audit data to Splunk. Without this telemetry, the primary exploitation detection chain cannot function. This is a critical visibility gap if not already in place.
• Run a retrospective hunt in available Corelight HTTP logs (index=corelight sourcetype=corelight_http) for the past 30-90 days, looking for high-volume OAuth-related requests to known BIG-IP APM virtual server destination IPs.
• Coordinate with the network engineering team to confirm that BIG-IP APM virtual servers running End of Technical Support software versions are identified and scheduled for upgrade, as F5 did not evaluate those versions for CVE-2026-94127.
• Review tmctl global_oauth_stat counters on each BIG-IP appliance for unexpected spikes in OAuth-related processing that may indicate exploitation attempts.
• As a defense-in-depth measure, restrict BIG-IP management interface access to trusted networks only, while recognizing this does not mitigate CVE-2026-94127 since the attack vector is through client-facing data plane traffic.

Sources

• BleepingComputer - F5 warns of BIG-IP APM remote code execution zero-day exploited in attacks
• The Hacker News - F5 Patches Critical BIG-IP APM Zero-Day
• CERT-EU Advisory 2026-013
• Canadian Centre for Cyber Security - AL26-022 Vulnerability Impacting F5 BIG-IP APM
• WindowsForum - CVE-2026-94127 F5 BIG-IP APM Hotfixes for Actively Exploited OAuth RCE
• Shattered.io - F5 BIG-IP Zero-Day CVE-2026-94127
• Dev.to - CVE-2026-94127 What F5 BIG-IP Operators Need to Know
• Field Effect - F5 Fixes BIG-IP APM Vulnerability
• SOC Prime - CVE-2026-94127 Analysis
• Rapid7 - ETR CVE-2026-94127 Critical Unauthenticated RCE in F5 BIG-IP APM
• CISA - CISA Adds Four Known Exploited Vulnerabilities to Catalog
• F5 Advisory K000162605
• NVD Entry for CVE-2026-94127