> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Someone's attacking a critical 0-day RCE in F5 BIG-IP APM - URL: https://f4n6.co.uk/security-feed/someones-attacking-a-critical-0-day-rce-in-f5-big-ip-apm/ - Published: 2026-09-23T20:05:20.000Z - Updated: 2026-09-23T20:05:20.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-94127, CVE-2023-46747, UNC5174 ## 1\. Executive summary F5 has fixed CVE-2026-94127, a heap-based buffer overflow (CWE-122) in BIG-IP Access Policy Manager that allows an unauthenticated attacker with network access to an affected virtual server to run code on the BIG-IP data plane. The verified reference data scores it CVSS 9.3 CRITICAL and records it in CISA KEV as of 2026-09-22, with EPSS at 1%. F5 states the flaw has been exploited, and exposure is narrow but specific: the virtual server must have both an APM access policy and an OAuth profile configured, which is the configuration used when APM acts as an OAuth authorization server. For EMEA financial services the affected systems sit at the network edge and broker authentication into internal applications, so a successful exploit puts unauthenticated code execution on a device that already holds trust relationships across the estate. Patch or isolate now; the only interim mitigation is an iRule that F5 releases through a support case. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18 | F5 confirms CVE-2026-94127 is being exploited in the wild and CISA added it to KEV on 2026-09-22; the article covers classification of cyber threats, not only realised incidents. | Affected entities must classify this as a cyber threat: record which virtual servers carry the APM plus OAuth profile combination, decide whether it is significant, and retain the assessment for the competent authority. | | DORA Art. 19 | The vulnerability is an unauthenticated RCE on an internet-facing authentication proxy, so any successful exploitation produces an incident that must be tested against the major-incident criteria. | If a BIG-IP APM is compromised, the incident has to be assessed against the major-incident criteria and reported to the competent authority if it qualifies. | | DORA Art. 30 | The only interim mitigation is an iRule workaround that F5 releases only through a support case, so the speed of vendor assistance depends on the contract in place. | Check that the F5 contract obliges timely assistance and fixes, and open the support case now rather than at the point of compromise. | ## 3\. Technical analysis & attack chain Confirmed steps, from F5's advisory as reported: 1. F5 published a security advisory for CVE-2026-94127 on 22 September 2026 and released engineering hotfixes. 2. The flaw is a heap-based buffer overflow (CWE-122) in BIG-IP APM. 3. Exposure requires a BIG-IP virtual server configured with both an APM access policy and an OAuth profile on the same virtual server, that is, APM acting as an OAuth authorization server issuing access tokens to applications. 4. An unauthenticated attacker with network access to that virtual server sends specifically crafted traffic. No credentials are needed. 5. Successful exploitation yields remote code execution on the BIG-IP data plane. The vulnerability does not expose the BIG-IP control plane, and systems running in Appliance mode are also affected. 6. F5 states the vulnerability has been exploited. CISA added it to KEV on 2026-09-22; the KEV entry lists a remediation due date of 2026-09-25 for US federal agencies. The sources stop there. There is no public detail on the post-exploitation payload, persistence mechanism, command-and-control, lateral movement, data access or observed impact, and F5 did not answer questions about how many systems have been compromised or whether the exploit has been used to deploy ransomware. The CISA KEV entry records known ransomware campaign use as "Unknown". Rapid7 notes that as of 22 September no publicly available proof of concept had been confirmed. Two data points need flagging rather than smoothing over. Rapid7's post gives the vulnerability a CVSS v3.1 score of 9.8; the verified reference data and F5's own scoring give 9.3, and we use 9.3 throughout. Separately, the ANSSI alert of 31 March 2026 in the source set concerns CVE-2025-53521, a different BIG-IP APM remote code execution flaw that F5 confirmed as actively exploited on 29 March 2026\. It is not evidence about CVE-2026-94127 and the two should not be conflated in reporting. Attribution is unconfirmed and should stay that way. The Register notes that Mandiant linked exploitation of CVE-2023-46747, an older and separate BIG-IP authentication bypass, to UNC5174, an access broker it assessed with moderate confidence as operating from China, which attempted to sell access to US defense contractor appliances and UK government entities. That finding is single-sourced (Mandiant, via The Register), concerns a different CVE, and does not establish who is exploiting CVE-2026-94127\. The verified reference data holds no MITRE ATT&CK profile for UNC5174, so the attribution is unconfirmed and must not drive blocking, escalation or customer notification decisions. For completeness, CVE-2023-46747 is itself CVSS 9.8 CRITICAL, in KEV since 2023-10-31, with EPSS at 97% and classified CWE-288 and CWE-306. ## 4\. Mitigation & containment ### P1 (within 24 hours) - Inventory every BIG-IP virtual server that has both an APM access policy and an OAuth profile configured. Systems without that combination are not exposed to this CVE, and confirming that is the fastest way to shrink the problem. - Patch exposed systems to the fixed hotfix for the release train in use: BIG-IP 21.1.0 to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG or later; BIG-IP 17.5.0 to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG or later; BIG-IP 17.1.0 to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG or later. - Where patching cannot complete inside 24 hours, open an F5 support case to obtain the vendor iRule workaround and apply it per F5's implementation guidance. In parallel, restrict network reachability to the OAuth virtual server to known source ranges, or take the virtual server out of service if it is internet-facing and cannot be constrained. - Do not treat Appliance mode as a control here. Rapid7 states that Appliance mode systems are affected. - Obtain the indicators of compromise that F5 published with its advisory (ANSSI's advisory of 23 September 2026 states they are available there) and hunt on every exposed system. ### P2 (within 72 hours) - Confirm CVE-2023-46747 is patched on the same estate. It is CVSS 9.8, in KEV since 2023-10-31, and carries EPSS at 97%, so any BIG-IP still carrying it is a higher-probability target than the CVE in this advisory. - Review APM and OAuth virtual server logs for unauthenticated requests that coincide with unexpected process activity or restarts on the BIG-IP. - If compromise cannot be excluded, treat the BIG-IP as untrusted: check for unauthorised local accounts, iRules and virtual servers, and rotate credentials and tokens that the APM brokers. ### P3 (within 7 days) - Review the F5 contract against DORA Art. 30, specifically the assistance and fix-delivery provisions, given that the interim mitigation is gated behind a support case. - Re-scan with vendor checks. Rapid7 states that Exposure Command, Vulnerability Management and Nexpose checks for CVE-2026-94127 were expected in its 23 September content release. - Confirm no residual vulnerable virtual servers remain after the hotfix cycle, including in disaster recovery and non-production estates that share the same configuration. ## 5\. Indicators of compromise No indicators of compromise available in the source material. ANSSI's advisory of 23 September 2026 states that indicators of compromise are published in F5's vendor advisory. We have not obtained that advisory, so no atomic indicators are reproduced here. Until it is retrieved, F5's advisory is the authoritative source for IOCs on this vulnerability. ## 6\. Detection Insufficient indicators to author detection rules. The sources contain no file names, command lines, mutexes, registry keys, scheduled-task names or network artefacts belonging to the exploit itself. The only distinctive strings available are CVE identifiers, product names and hotfix version numbers, which detect reporting about the vulnerability rather than the vulnerability. Detection effort should go into the configuration audit and log review in §4 until F5's published IOCs are in hand. ## CVE assessment 2 referenced CVEs — **2 actively exploited (CISA KEV)**, 2 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2023-46747](https://nvd.nist.gov/vuln/detail/CVE-2023-46747?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2023-10-31 | 97% | Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP sy… | | [CVE-2026-94127](https://nvd.nist.gov/vuln/detail/CVE-2026-94127?ref=f4n6.co.uk) | 9.3 Critical | ⚠ KEV 2026-09-22 | 1% | When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to… | ## 7\. Sources - The Register, "Someone's attacking a critical 0-day RCE in F5 BIG-IP APM", https://www.theregister.com/security/2026/09/23/someones-attacking-a-critical-0-day-rce-in-f5-big-ip-apm/5298659, 2026-09-23 - The Hacker News, "F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers", https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html, September 2026 - Rapid7, "CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM", https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm, 2026-09-22 - CISA Known Exploited Vulnerabilities, CVE-2026-94127, F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-94127, KEV added 2026-09-22 - ANSSI, CERTFR-2026-AVI-1220, "Vulnérabilité dans F5 BIG-IP", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1220/, 2026-09-23 - ANSSI, CERTFR-2026-ALE-004, "Vulnérabilité dans F5 BIG-IP Access Policy Manager", https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-004/, 2026-03-31 (concerns CVE-2025-53521, a different vulnerability) - Help Net Security, "Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances", https://www.helpnetsecurity.com/2026/09/23/check-point-f5-big-ip-apm-zero-days-targeted/, 2026-09-23 ## 8\. Adverse Trace position We assess CVE-2026-94127 as a high-priority patch for any EMEA financial services client running BIG-IP APM as an OAuth authorization server, on the strength of the verified CVSS 9.3 CRITICAL score, the CISA KEV listing of 2026-09-22 and F5's confirmation of exploitation; the EPSS value of 1% is low for a KEV-listed vulnerability and we treat it as a data point rather than a reason to deprioritise. Client impact is concentrated but severe: the affected configuration is an authentication proxy at the network edge, so code execution there sits behind the perimeter and in front of the applications it brokers. We will obtain F5's advisory and extract the published indicators of compromise, then circulate them with a detection update; we will also track whether any vendor or national CERT attributes this exploitation, and we will not repeat the UNC5174 link as an attribution for this campaign while it rests on a single source and a different CVE. Clients who cannot confirm their virtual server configuration within 24 hours should contact us. --- [Read the original source →](https://www.theregister.com/security/2026/09/23/someones-attacking-a-critical-0-day-rce-in-f5-big-ip-apm/5298659?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*