Check and patch F5 BIG-IP APM for CVE-2026-94127
F5 reports active exploitation of a heap-based buffer overflow that can enable unauthenticated remote code execution. Exposure requires BIG-IP APM to act as an OAuth Authorization Server with an APM access policy and OAuth profile on the same virtual server.
Imagine a storeroom shelf assigned a fixed space for each package. If a package crosses its allotted boundary, it can spill into nearby storage. F5 identifies this flaw as a heap-based buffer overflow. WatchTowr's binary-level patch analysis below explains the observed size check; F5 has not published the source code. This analogy conveys the memory-boundary idea, not the implementation.
Affected configuration
Exposure check: inspect the same virtual server for an APM access policy and an OAuth profile, then confirm whether APM is configured as the OAuth Authorization Server. A virtual server that uses APM only as an OAuth Client or Resource Server is outside the vendor's affected role description. F5 says end-of-technical-support versions were not evaluated; do not infer that an unsupported release is safe.
| Configuration on the virtual server | F5 assessment | Operator action |
|---|---|---|
| APM access policy and OAuth profile on the same virtual server; APM is an OAuth Authorization Server. | Affected when the BIG-IP release is in an affected range. | Treat as exposed; match the release to the hotfix table and investigate for compromise. |
| APM access policy and OAuth profile, but APM is only an OAuth Client or Resource Server; no Authorization Server profile. | F5 says this role-only configuration is not affected. | Record the role and profile inventory; reassess if an Authorization Server profile is also configured. |
| The affected Authorization Server configuration runs in Appliance mode. | F5 explicitly says Appliance mode is also vulnerable. | Apply the same affected-version check and remediation; Appliance mode is not an exclusion. |
| The release has reached End of Technical Support (EoTS). | F5 did not evaluate EoTS versions. | Treat status as unknown; ask F5 for guidance and do not infer that the release is safe. |
Affected BIG-IP versions and hotfixes
Version thresholds below follow the F5 CNA CVE record: F5 CNA record.
| BIG-IP branch | Affected range in F5's CVE record | Vendor hotfix |
|---|---|---|
| 17.1.0 | Before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG | Hotfix-BIGIP-17.1.3.5.0.41.14-ENG |
| 17.5.0 | Before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG | Hotfix-BIGIP-17.5.1.9.0.160.12-ENG |
| 21.1.0 | Before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG | Hotfix-BIGIP-21.1.0.2.0.30.22-ENG |
Root cause from published binary-diff analysis
WatchTowr compared vulnerable BIG-IP 21.1.0 with the fixed hotfix and reports that the TMM OAuth-processing path allocates a 0x4100-byte heap buffer, then copies the Authorization-header value without first checking that it fits. The fixed binary checks the length before copying and rejects values larger than the buffer. This is WatchTowr's reverse engineering of compiled binaries, not an F5 source-code diff; F5 does not publish the relevant source or function names. The finding explains the CWE-122 boundary failure without reconstructing a trigger request, payload, or control-flow hijack.
Detection and compromise triage
Use F5's indicators as triage signals, not proof by themselves. Review /var/log/apm for repeated OAuth invalid-token failures, especially ten or more from one IP in a short period. Check for an unexplained rise in total_failed with the read-only command tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed. If failures appear, review /var/log/audit for suspicious commands at the same times. Investigate TMM core files and SIGABRT events in context; F5 says a core file alone does not prove compromise. CERT-EU relays F5's detection guidance.
F5's CVE record says an iRule mitigation is available by opening a support ticket. Treat it as temporary and follow F5's instructions for the affected virtual server. Install the branch-specific vendor hotfix as the permanent remediation. Preserve evidence and investigate possible compromise because exploitation was reported before disclosure; patching alone does not establish that a device is clean.
Remediation checklist
- Inventory BIG-IP APM virtual servers and record whether each has both an APM access policy and an OAuth profile.
- Confirm the OAuth role. Prioritize Authorization Server configurations; do not classify Client/Resource Server-only configurations as affected by this CVE.
- Record the exact software branch and compare it with F5's hotfix threshold above. For unsupported versions, ask F5 for supported remediation; do not infer non-affected status.
- If the hotfix cannot be installed immediately, contact F5 Support for the temporary iRule and apply it only as directed by the vendor.
- Preserve relevant logs, review the indicators above, and follow incident response procedures if suspicious activity is found. Then install the matching hotfix and verify every affected virtual server and HA peer.