F5 BIG-IP APM zero-day exploited when used as an OAuth authorization server

F5 disclosed CVE-2026-94127 on September 22, 2026, a heap-based buffer overflow in BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution and is being actively exploited, The Hacker News reported. It is rated CVSS 9.8 (v3.1). CISA added it to the Known Exploited Vulnerabilities catalog the same day and gave federal civilian agencies until September 25 to apply F5's mitigations. Hotfixes are available for the 21.1, 17.5 and 17.1 branches.

The exposure is narrower than many BIG-IP issues, but serious where it applies. Only systems where APM acts as an OAuth authorization server, with an APM access policy and an OAuth authorization server profile on the same virtual server, are affected. Restricting the management interface does not help, because the attack arrives through the virtual server that handles user traffic. Systems patched earlier for CVE-2025-53521 still need this new hotfix. Versions past end of technical support were not evaluated.

Ask your F5 administrator whether any virtual server combines those two configurations. If so, CERT-EU advises preserving forensic evidence before making changes; CISA recommends applying F5's iRule mitigation (requested through a support ticket) first if the hotfix cannot go on immediately, then installing the hotfix. Review APM logs for repeated failed UserInfo requests with the error 'The access token is invalid,' unexplained increases in OAuth failure counters, and suspicious commands in the audit log.

F5 has not said how many systems were attacked or whether the hotfix removes access an attacker already gained, so treat exposed systems as needing investigation, not only patching.