{"type":"bundle","id":"bundle--2a1494be-fdd2-58f8-b6d3-b09cfce21651","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"vulnerability","spec_version":"2.1","id":"vulnerability--caf96f46-bdfd-5402-9943-cbfe3bc400d3","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T23:51:41.706898Z","modified":"2026-09-24T23:51:41.706898Z","name":"CVE-2026-94127","description":"Heap-based buffer overflow in F5 BIG-IP APM that may allow unauthenticated remote code execution in the affected OAuth configuration.","external_references":[{"source_name":"cve","external_id":"CVE-2026-94127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94127"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T23:51:41.706898Z","modified":"2026-09-24T23:51:41.706898Z","name":"Exploit Public-Facing Application","external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0815d4f-24c1-558a-af3b-ea12e3dd342f","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T23:51:41.706898Z","modified":"2026-09-24T23:51:41.706898Z","name":"SIGMA: F5 BIG-IP APM suspicious post-exploitation shell","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'F5 BIG-IP APM suspicious post-exploitation shell']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-09-24T23:51:41.706898Z","confidence":95},{"type":"relationship","spec_version":"2.1","id":"relationship--e444174f-979e-52ba-b457-3cb774a1eda5","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T23:51:41.706898Z","modified":"2026-09-24T23:51:41.706898Z","relationship_type":"indicates","source_ref":"indicator--b0815d4f-24c1-558a-af3b-ea12e3dd342f","target_ref":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09"},{"type":"relationship","spec_version":"2.1","id":"relationship--1d72428b-b926-57c7-a832-b6b89be474c9","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T23:51:41.706898Z","modified":"2026-09-24T23:51:41.706898Z","relationship_type":"targets","source_ref":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","target_ref":"vulnerability--caf96f46-bdfd-5402-9943-cbfe3bc400d3"},{"type":"report","spec_version":"2.1","id":"report--a3f94bbc-3566-5e05-af2f-6324c9ae99df","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T23:51:41.706898Z","modified":"2026-10-30T14:11:25.683046Z","name":"F5 BIG-IP APM zero-day exploitation","description":"Public evidence documents active exploitation of CVE-2026-94127, a critical F5 BIG-IP APM heap-based buffer overflow that can enable unauthenticated remote code execution in a specific OAuth configuration.","published":"2026-09-24T23:51:41.706898Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","vulnerability--caf96f46-bdfd-5402-9943-cbfe3bc400d3","attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","indicator--b0815d4f-24c1-558a-af3b-ea12e3dd342f","relationship--e444174f-979e-52ba-b457-3cb774a1eda5","relationship--1d72428b-b926-57c7-a832-b6b89be474c9"],"confidence":95}]}