This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] F5 BIG-IP fixes an actively exploited vulnerability

F5 fixes a critical [1], actively exploited [2] vulnerability in BIG-IP.

F5 BIG-IP – RCE (CVE-2026-94127)
CVSS 9.3 (Critical)

An unauthenticated remote attacker can, due to a heap buffer overflow in the Access Policy Manager (APM) module, execute arbitrary code on the BIG-IP device by sending specially crafted network traffic to a virtual server. The vulnerable configuration is one where both an APM access policy and an OAuth authorization server (AS) profile are configured on the given virtual server, i.e. APM itself issues access tokens. APM acting only as an OAuth Client or Resource Server (without an OAuth AS profile) is not vulnerable [1]. A compromise may be indicated by a combination of repeated failed OAuth UserInfo requests with the “invalid_token” error in /var/log/apm, suspicious commands in /var/log/audit and a subsequent crash of the TMM process (SIGABRT). A detailed description of the IoCs and recommendations can be found at [1].

The vulnerability is present in product:

  • BIG-IP; >=17.1.0, <Hotfix-BIGIP-17.1.3.5.0.41.14-ENG; >=17.5.0, <Hotfix-BIGIP-17.5.1.9.0.160.12-ENG; >=21.1.0, <Hotfix-BIGIP-21.1.0.2.0.30.22-ENG;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 22. 9. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 23. 9. 2026.

CESNET, z.s.p.o. Logo