What is confirmed
Active exploitation against a particular APM configuration
CVE-2026-94127 is a heap-based buffer overflow in BIG-IP Access Policy Manager. F5 says unauthenticated remote code execution is possible when APM is configured as an OAuth authorization server. Deployments that use APM only as an OAuth client or resource server are not affected by this flaw.
The vulnerable path is on the data plane: traffic reaches the virtual server performing the authorization-server role. Restricting the administrative interface does not remove this exposure. CISA’s addition of the CVE to the Known Exploited Vulnerabilities catalog confirms evidence of exploitation, but public advisories do not describe every victim or post-exploitation action.
Threat Field Notes assessment
Scope
Trace the configuration that provides authorization
| Check | Affected signal | Why it matters |
|---|---|---|
| Provisioned module | BIG-IP APM is installed and in service | Narrows the estate but does not prove the vulnerable role is configured. |
| OAuth role | APM acts as an authorization server | Client-only and resource-server-only use is outside the vendor’s stated exposure. |
| Virtual server relationship | An OAuth profile and access policy are attached to the traffic-handling virtual server | Shows where untrusted requests can reach the vulnerable function. |
| Running build and hotfix | The exact F5 engineering hotfix is installed for the supported branch | A broad release number alone may not include the correction. |
Do not interpret an end-of-support version missing from the evaluated list as safe. Escalate unsupported systems to the vendor and the system owner, and plan replacement rather than improvising from another branch’s hotfix.
Response
Preserve evidence before the change window closes it
- 1
Identify exposed authorization servers. Map virtual servers, OAuth profiles, access policies, internet reachability, application dependencies, and the responsible owner for every appliance.
- 2
Collect volatile and external evidence. Follow F5 and incident-response guidance before restarting services. Retain load-balancer, network, authentication, token, EDR, and centralized logs that do not depend on the appliance remaining trustworthy.
- 3
Install and verify the correct hotfix. Use the exact package for the running release branch, validate the installed build, and test authorization flows. Record exceptions and temporary exposure reductions.
- 4
Assess the trust radius. If exploitation is suspected, investigate changes to the appliance and review connected applications, OAuth clients, issued tokens, secrets, and administrative identities. Rotate trust material based on evidence and recovery guidance.
Editorial note
How this analysis was prepared
This story was surfaced by The Cyber Security Hub newsletter. Threat Field Notes checked the vendor advisory, CISA’s exploitation status, and public technical analysis, then wrote this independent response. Details about post-exploitation impact are framed as investigation questions unless the cited sources confirm them.