From OAuth Profile to Root: Tracing the CVE-2026-94127 Attack Path in F5 BIG-IP APM

To exploit CVE-2026-94127, an attacker does not require any credentials, sessions, or users. Instead, they only need a network path leading to a BIG-IP virtual server with an APM access policy and an OAuth profile. F5 has rated the vulnerability as high severity (9.8) on the CVSS v3.1 scale and acknowledges that it is being actively exploited.

The attack chain begins with identifying a suitable BIG-IP virtual server where APM is enabled, an access policy is attached, and an OAuth profile is configured. This configuration is not unusual in organizations that utilize BIG-IP APM for single sign-on and OAuth-based access control. Using a ZoomEye query, the analysis identified 59,063 instances globally, highlighting the widespread deployment of this vulnerable pattern.

The vulnerable code resides within the Traffic Management Microkernel (TMM), which processes traffic for the virtual servers. By sending traffic to the affected virtual server, the attacker triggers the vulnerable code path, specifically the OAuth handling function. This step bypasses common security controls, such as isolating the management interface or enabling appliance mode, since the flaw exists at the data plane level.

The core vulnerability is a heap-based buffer overflow in the OAuth profile handling mechanism. The flaw allows an attacker to write oversized data into a heap allocation without proper validation. This corrupts adjacent heap memory, creating conditions that can lead to arbitrary code execution. The attacker can manipulate the corrupted heap region to execute malicious code within the TMM process, which handles traffic for the virtual servers.

Once the attacker gains code execution within TMM, they can exploit the wider attack surface. They can observe and manipulate traffic across the BIG-IP appliance, initiate connections to internal services that trust the gateway, and use the compromised device as a launchpad for lateral movement within the network. This compromise can extend beyond the initially targeted virtual server, potentially exposing multiple applications.

F5 has released hotfixes for the affected BIG-IP versions (21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3). Organizations should apply the appropriate hotfix as soon as possible, as a stopgap measure. For critical situations, an emergency iRule is available from F5 Support, though it should be removed post-upgrade.