What happened
On September 22, 2026, the Canadian Centre for Cyber Security said F5 had reported active exploitation of CVE-2026-94127 and published fixed hotfix releases. CVE-2026-94127 is a heap-based buffer overflow affecting BIG-IP APM when an access policy and an OAuth profile are configured on the same virtual server. Under that condition, specially crafted unauthenticated traffic can execute code on the affected device and potentially produce full system compromise. APM deployments used only as an OAuth client or resource server are outside the configuration described by F5 in the corroborating reporting.
The fixed releases are Hotfix-BIGIP-17.1.3.5.0.41.14-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG and Hotfix-BIGIP-21.1.0.2.0.30.22-ENG. The Cyber Centre also relayed an F5 support iRule as an interim mitigation, urged organisations to restrict management interfaces to trusted administrative networks and advised review of OAuth authentication failures, administrative accounts and access-policy changes. Organisations using evaluated configurations still need to reconcile emergency remediation with their certification and change-control requirements.
Shadowserver telemetry cited by CSO tracked more than 15,000 internet-exposed BIG-IP APM deployments, but that count does not establish how many meet the vulnerable OAuth-server configuration. Administrators can count the relevant failures with tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed and then review available audit logs and TMM core files around suspicious timestamps. F5’s cited guidance treats repeated OAuth failures, suspicious commands and a nearby TMM SIGABRT as a correlation requiring human review rather than a single definitive indicator.
No attacker IP addresses, domains, filenames or file hashes were published in the cited sources. That absence increases the importance of local behavioural and configuration evidence and prevents a narrow indicator-only hunt from proving non-compromise. Attribution posture: F5 and the Cyber Centre identify active exploitation but name no threat actor in the cited sources.
Why this matters now
BIG-IP APM commonly sits on a trusted access boundary between internet users and internal applications. The affected condition is narrower than every APM deployment, but where an access policy and OAuth profile coexist on a virtual server, the cited authorities describe unauthenticated remote code execution and possible full system compromise. That combination makes configuration evidence more important than a product-name inventory and raises the consequence of incomplete discovery.
The operational decision is not simply whether a hotfix has been installed. Confirmed active exploitation means vulnerable systems may have processed malicious traffic before remediation, while OAuth failures and TMM crashes can also occur for benign reasons. Security teams therefore need correlated evidence across configuration, authentication failures, audit activity, administrative changes and crash artefacts. Business owners must also plan for emergency changes to access infrastructure that may support remote work or application authentication.
The decision for security leaders
Assign network engineering to produce a configuration-level exposure list, not a procurement or CMDB list of every F5 device. Each relevant virtual server needs an owner, external-exposure state, current software and hotfix level, OAuth role, maintenance plan and business dependency. Where immediate patching is unsafe, use the vendor-provided mitigation and document the time-bounded exception, compensating controls and accountable risk owner.
Run incident response in parallel with remediation. Patching changes future exploitability but does not determine whether malicious traffic already reached the device. Require a documented review of authentication failures, audit logs, administrative accounts, access-policy changes, suspicious commands and TMM crash artefacts. Any anomaly should remain an incident-response case until its cause and downstream access are resolved; a successful version scan alone is insufficient closure.
Evidence of closure
- Configuration export showing every relevant virtual server and its APM/OAuth profile state.
- Version evidence showing an approved fixed hotfix on every exposed affected device.
- Signed hunt result covering OAuth failures, available audit logs, administrative changes and TMM cores.
- Incident-response disposition for every anomaly found before patching.
The Security.io assessment
The exposure is simultaneously broad and configuration-specific. The internet deployment estimate supports urgent discovery, but it must not be converted into a vulnerable-device count without evidence that an APM access policy and OAuth profile coexist. This distinction matters operationally: treating every deployment as identical wastes emergency capacity, while relying on product inventory alone can miss the exact virtual-server condition that enables exploitation.
The lead ranks above today’s other developments because it combines confirmed active exploitation, unauthenticated code execution, internet-facing placement and a narrow remediation window on infrastructure that mediates enterprise access. The absence of actor attribution and atomic indicators does not reduce urgency; it shifts closure toward configuration exports, behavioural review and incident evidence. Security.io’s assessment remains high urgency until affected instances are fixed and pre-remediation activity is dispositioned.
Questions for the morning meeting
- Which business services depend on the affected APM virtual servers?
- Can network engineering patch without breaking remote access or OAuth authorisation?
- Who accepts residual risk if compromise assessment cannot finish today?