F5 has recently addressed a critical remote code execution vulnerability in its BIG-IP Access Policy Manager (APM), now designated as CVE-2026-94127. The vulnerability was already being actively exploited prior to the release of the patch, leaving over 15,000 deployments potentially at risk, as reported by the Shadowserver Foundation.
This CVE affects instances of BIG-IP APM configured as OAuth authorization servers, which are integral for managing access to internal network resources, including various authorization and authentication processes. It has been rated 9.8 on the CVSS scale, indicating its severity. The flaw can also impact the BIG-IP system when it is configured in appliance mode, but exploitation requires both APM and an OAuth authorization server profile to be enabled.
Deployments that only utilize APM as an OAuth client or resource server remain unaffected. To mitigate risk, F5 has released specific hotfixes: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso for the 21.x release, and Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG.iso for the older supported 17.5.x and 17.1.x branches.
In addition to these fixes, F5 has provided an iRule available through their support portal to act as temporary mitigation until the patch can be applied.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing that it is being exploited in real-world attacks. CISA estimates that a significant sample of around 10,000 BIG-IP APM installations, particularly in North America and Europe, are exposed to the internet, making them susceptible to this vulnerability.
F5 has advised users to monitor for various indicators of compromise. They suggest that multiple OAuth authentication failures, particularly when occurring frequently from the same IP address, should trigger further investigation. Some indicative commands from F5 allow system administrators to check for such failures, ultimately helping them detect potential exploitation.
The exploitation of BIG-IP APM and other F5 appliances has become a trend for attackers in recent years, further highlighted by various incidents and vulnerabilities targeting network edge devices and VPN gateways, which serve as significant entry points for infiltrating corporate networks. Recently, a Linux rootkit specifically designed for BIG-IP APM systems was discovered, showcasing ongoing exploitation efforts related to prior vulnerabilities.
For further details about the vulnerability and mitigation, please refer to F5’s advisory and the CISA alert.
