F5 reports an actively exploited vulnerability in BIG-IP APM that allows attackers to execute code without a login. A quick patch is required.
F5 has discovered and resolved a critical vulnerability in BIG-IP APM. The vulnerability allows attackers without credentials to execute code on affected systems. The company confirms that the flaw (CVE-2026-94127) is already being actively exploited.
The vulnerability is located in the Access Policy Manager (APM). This is the F5 module that manages access policy and authentication on BIG-IP systems. Administrators use this module to configure and secure network access. The component responsible for securing the front door now appears to be defective itself, which explains why the bug received a CVSS score of 9.8 (4.0) and is therefore critical.
What is going wrong?
The problem arises when a BIG-IP APM access policy is configured on a virtual server along with an OAuth profile, and the system acts as an OAuth Authorization Server. In this scenario, malicious traffic can cause a heap buffer overflow, ultimately leading to remote code execution. Companies that only use APM as an OAuth client or resource server, without an authorization server profile, are not at risk.
Importantly, an attacker does not need authentication to exploit the vulnerability. Furthermore, it is an issue on the dataplane, not the controlplane, meaning the management of the device itself is not directly exposed. F5 emphasizes this in its advisory.
Affected versions and recovery
The vulnerability affects BIG-IP APM in the 21.x branch from version 21.1.0, and in the 17.x branch versions 17.5.0 to 17.5.1 and 17.1.0 to 17.1.3. F5 provides hotfixes for each affected variant. Other BIG-IP modules, BIG-IQ, F5OS, NGINX, and Distributed Cloud services are not susceptible to this bug.
Companies that cannot yet install the patch can apply a temporary iRule to the affected virtual server. This measure is available through F5 customer service. The company also advises organizations to check log files for repeated OAuth errors from a single IP address, followed by suspicious commands and a crash of the TMM process. This combination of signals may indicate an active attack.
Prompt patching remains necessary
Because the vulnerability is already being actively exploited, F5 recommends patching or applying the mitigation as soon as possible. Organizations using BIG-IP APM with OAuth authentication are advised to check and update their systems. Sifting through logs for signs of exposure is also recommended.