The Config That Turned F5's OAuth Server Into an Unauthenticated Backdoor
CVE-2026-94127 is a heap overflow in BIG-IP APM that only exists on one specific configuration: an access policy and an OAuth authorization server profile on the same virtual server. F5 disclosed it already under attack.
CVE-2026-94127 is a heap overflow in BIG-IP APM that only exists on one specific configuration: an access policy and an OAuth authorization server profile on the same virtual server. F5 disclosed it already under attack.
September 26, 2026 · 5 min read
F5 BIG-IP Access Policy Manager (APM) is the module that decides who gets into an organization's applications, networks, and APIs before anything else runs. On September 22, F5 disclosed CVE-2026-94127, a critical heap-based buffer overflow in APM's OAuth handling, and confirmed it had already been exploited before the advisory existed. CISA added it to the Known Exploited Vulnerabilities catalog the same day.
One Configuration, Not the Whole Product
Not every BIG-IP APM deployment is exposed. The flaw only triggers when a single virtual server carries both an APM access policy and an OAuth authorization server profile at the same time, meaning APM is not just checking OAuth tokens but issuing them: authorization codes, access tokens, and refresh tokens for other applications to consume. Deployments where APM acts purely as an OAuth client or resource server, consuming tokens rather than issuing them, are not affected.
This distinction matters because it is easy to assume any APM installation with OAuth turned on is at risk. It is not. The vulnerable role is specifically the authorization server, the component doing the token-issuing work, and the flaw sits in the code path that handles that traffic.
The Mechanism
The vulnerability is CWE-122, a heap-based buffer overflow: specially crafted traffic reaching the OAuth processing logic writes data beyond the boundary of an allocated memory region on the heap. When an attacker controls what gets written past that boundary and where, memory corruption becomes a path to arbitrary code execution rather than just a crash. F5 has not published the specific malformed request or memory layout the exploit relies on, standard practice for a flaw still being remediated across the install base.
The attack requires no authentication and no user interaction. It reaches the system through the data plane, the traffic-handling path, not the administrative control plane, and it works whether or not the system is running in Appliance Mode. F5 rates it 9.8 on CVSS v3.1 and 9.3 on CVSS v4.0.
Patched in March Does Not Mean Patched Now
A separate APM flaw, CVE-2025-53521, was added to the KEV catalog back in March. Its fixes for the 17.1 and 17.5 branches, versions 17.1.3 and 17.5.1.3, sit inside the version ranges CVE-2026-94127 now affects. An administrator who patched in March and has not touched the system since is still exposed. The new hotfix is a separate, additional install, not something the March patch already covered.
Timeline
F5 published advisory K000162605 on September 22 alongside engineering hotfixes for the affected branches: 17.1.0 through 17.1.3, 17.5.0 through 17.5.1, and 21.1.0. CISA's same-day KEV addition means confirmed exploitation predated the public advisory. Federal civilian agencies were given until September 25, a three-day window, under Binding Operational Directive 26-04, reflecting how CISA treats confirmed pre-disclosure exploitation differently from a routine patch cycle.
Shadowserver has counted more than 14,700 internet-facing BIG-IP APM instances. That number says nothing about how many run the vulnerable authorization-server configuration specifically, or how many are already patched. It is a ceiling, not an exposure estimate.
Patch and Detect
The hotfixes are available now: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG, for the three affected branches respectively. Where an immediate hotfix install is not possible, F5 provides an iRule mitigation for the affected virtual server, available by opening a support ticket.
For systems that were internet-facing before patching, checking for signs of compromise matters as much as installing the fix. The indicator pattern worth correlating across logs: a cluster of OAuth token validation failures from the same source, followed by a TMM process crash, followed by unexpected command execution. Each event happens for ordinary reasons in isolation. In that sequence, on a system running the vulnerable configuration, they are the signature tied to this specific exploit.
An access policy and an OAuth authorization server profile living on the same virtual server is an ordinary, supported configuration, not a misconfiguration. The vulnerability was in what F5's own code did with traffic that setup was built to receive.