F5 has released security updates for a critical vulnerability in BIG-IP Access Policy Manager that is already being used in remote code execution attacks. Tracked as CVE-2026-94127, the flaw puts every affected BIG-IP APM deployment configured as an OAuth Authorization Server at risk, while installations used strictly as an OAuth Client or Resource Server are not affected. CISA has added the bug to its Known Exploited Vulnerabilities catalog and given U.S. federal agencies until Friday to secure their networks.<\/p>\n
An organization that runs BIG-IP APM with both an access policy and an OAuth profile on a virtual server should treat the device as exposed until patched. F5’s advisory confirms exploitation in the wild and points to a specific signal to look for: a burst of OAuth authentication failures paired with suspicious commands, followed soon after by a TMM SIGABRT crash. TMM is F5’s traffic management microkernel, and a SIGABRT is an abnormal termination dump, so the trio of failed authentications, odd shell activity and a sudden TMM crash is the practical tripwire defenders should search their logs for.<\/p>\n
Two responses are available right now. The first is to install the new F5 security updates on every affected BIG-IP APM virtual server. The second, for environments that cannot patch immediately, is to apply an iRule available from F5 Support to the affected virtual server. Both options come from F5’s own guidance published alongside the patches.<\/p>\n
Internet exposure remains significant. Shadowserver is currently tracking over 14,700 IP addresses with BIG-IP APM fingerprints reachable online. The monitoring project notes that it does not know how many of those instances have already been patched or are running as honeypots, so the 14,700 figure is a maximum exposure line rather than a confirmed victim count. Even with that caveat, the number shows that a widely deployed access control product with a known-exploited bug is sitting within reach of attackers on the public internet.<\/p>\n
CISA’s Known Exploited Vulnerabilities catalog flags bugs that are confirmed to be in active use by attackers, and CVE-2026-94127 was added the same day F5 published its advisory. The agency’s note describes these flaws as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise, which is why federal agencies are bound by a binding operational directive to remediate on the catalog’s schedule. CISA has now flagged eight F5 vulnerabilities since November 2021, four of which have also shown up in ransomware incidents.<\/p>\n
F5 products have been a frequent target for both financially motivated and state-backed groups in recent years. Past abuse of F5 flaws has led to corporate network breaches, device hijacks, internal server mapping, data-wiping malware deployment and theft of sensitive documents. In October 2025, F5 confirmed that state-sponsored intruders had breached its own systems in August 2025 and made off with BIG-IP security source code and vulnerability data, a disclosure that raised the bar on monitoring any new patch for signs of prior inside knowledge.<\/p>\n
F5 itself is a Fortune 500 company that provides cybersecurity, application delivery networking and related services to more than 23,000 customers worldwide, including 48 of the Fortune 50. That reach is why a single BIG-IP APM bug with a public exploit is treated as high priority by defenders and by government agencies at the same time.<\/p>\n
The practical detection path from F5’s advisory is narrow but clear. Pull BIG-IP APM logs for OAuth authentication failures in clusters rather than single events, then check for non-administrative commands issued on the device around the same window, and finally look for a TMM SIGABRT dump shortly after. Any environment showing that chain should be treated as compromised until proven otherwise, which typically means rotating credentials, capturing forensic images, and reviewing outbound traffic from the BIG-IP device during the same window.<\/p>\n
CVE-2026-94127 is a critical zero-day vulnerability in F5 BIG-IP Access Policy Manager that is being exploited in remote code execution attacks. It affects instances configured as an OAuth Authorization Server where a BIG-IP APM access policy and an OAuth profile are configured on the same virtual server.<\/p>\n
No. F5 states that deployments using BIG-IP APM strictly as an OAuth Client or Resource Server, without OAuth authorization server profiles configured, are not affected by the vulnerability.<\/p>\n
F5 advises applying an iRule, available from F5 Support, to the affected BIG-IP APM virtual server as a mitigation measure until the security update can be installed.<\/p>\n