F5 BIG-IP APM zero-day exploitation
Executive summary
Public evidence documents active exploitation of CVE-2026-94127, a critical F5 BIG-IP APM heap-based buffer overflow that can enable unauthenticated remote code execution in a specific OAuth configuration.
Technical analysis
CISA KEV, CERT-EU, and Rapid7 identify active exploitation. Rapid7 records the configuration prerequisite: an APM access policy and OAuth profile on a virtual server. This report describes public technology risk and does not assess any organization.
IOCs
No public IOC is available.
CVEs and affected products
Heap-based buffer overflow in F5 BIG-IP APM that may allow unauthenticated remote code execution in the affected OAuth configuration.
ATT&CK mapping
Exploit Public-Facing Application
Tactic: initial-access
Detection content
Sigma rules, YARA rules, Splunk SPL, and KQL detection logic.
Threat hunting
Hypothesis-driven hunt procedures and telemetry checklist.
Remediation
Containment actions, patching notes, and credential steps.
Historical relationships
No published historical relationship is available.
Timeline and change history
Confidence and caveats
0.95
⚠️ Public reporting does not establish exploitation of any specific organization.
⚠️ Vendor-specific hotfix details should be checked against the current F5 advisory before implementation.
📄
Intelligence Sources & Advisory Feeds
DFIR investigations, vendor research, advisory feeds & verified claims
4 references
▼
Evidence precedence is led by CISA and CERT-EU advisories, corroborated by Rapid7 research and the Canadian advisory.
CISA added CVE-2026-94127 F5 BIG-IP APM heap-based buffer overflow to the Known Exploited Vulnerabilities catalog based on active exploitation.
The Canadian advisory identifies CVE-2026-94127 as a zero-day vulnerability impacting F5 BIG-IP Access Policy Manager and records the public advisory update.
Rapid7 describes CVE-2026-94127 as a critical unauthenticated F5 BIG-IP APM remote code execution issue requiring an APM access policy and OAuth profile on a virtual server.
CERT-EU reports that F5 confirmed active exploitation of the critical vulnerability and recommends prompt action.