Technology vendor F5 released an emergency fix Tuesday for a critical security flaw in its BIG-IP Access Policy Manager (APM) platform that attackers were already exploiting in the wild, according to a report from CSO Online. The vulnerability threatens more than 15,000 systems exposed to the internet, with attackers capable of executing remote code on devices configured as OAuth authorization servers. BIG-IP APM is a software module within F5's BIG-IP hardware systems that companies deploy to manage access to internal network resources, handling authentication, authorization, client-side security checks, and VPN connections for remote workers.
The flaw, designated CVE-2026-94127, earned a severity rating of 9.8 on the CVSS scale and stems from a heap-based buffer overflow issue, the report states. The vulnerability affects BIG-IP systems running in appliance mode, but exploitation requires both APM and an OAuth authorization server profile to be configured simultaneously. Deployments using APM solely as an OAuth client or resource server face no risk, F5 clarified in its security advisory. The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog on Tuesday, confirming active attacks are underway. The Shadowserver Foundation's tracking data shows over 15,000 BIG-IP APM deployments accessible from the internet, with North America and Europe each accounting for roughly 5,000 installations.
F5 recommends administrators apply specific hotfixes depending on their software version: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso for the 21.x release branch, and either Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso or Hotfix-BIGIP 17.1.3.5.0.41.14-ENG.iso for the still-supported 17.5.x and 17.1.x branches. Beyond the patches, F5 made available an iRule through its support portal that organizations can deploy as a temporary safeguard until full patching is complete. "At a high level, multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT is the combination that should lead to human review of the system," the company stated. While OAuth authentication failures occur routinely, administrators should investigate when logs show more than 10 such messages, particularly if they originate from a single IP address. F5 advises checking for indicators of compromise using the command "tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed" and reviewing audit logs at /var/log/audit around suspicious timestamps, since exploitation can force the TMM component into a crash loop that generates core files.
The incident reflects a continuing pattern of attackers targeting network edge devices and VPN gateways as entry points into corporate networks, according to the report. BIG-IP APM and other F5 appliances have faced repeated targeting over recent years. Earlier this month, security researchers discovered a Linux rootkit implant purpose-built for BIG-IP APM systems, linked to exploitation of an older vulnerability tracked as CVE-2025-5352. The buffer overflow in CVE-2026-94127 allows attackers who can reach vulnerable OAuth endpoints to overwrite memory and inject malicious code, granting them control over systems that often sit at the boundary between public internet and private corporate resources. With thousands of internet-facing deployments and confirmed exploitation already in progress before the patch arrived, organizations running affected configurations face a narrow window to protect systems that control access to sensitive internal assets. The convergence of critical severity, active exploitation, and wide deployment makes immediate patching essential for any organization using BIG-IP APM as an OAuth authorization server. Organizations that can't patch immediately should deploy the iRule mitigation and closely monitor authentication logs for the specific pattern of repeated failures followed by suspicious activity that signals attempted exploitation.