Latest / The Digital Warfare Podcast / EP. 167: F5 BIG-IP Zero-Day CVE-2026-94127 Exploited for Remote Code Execution
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today, we're looking at a critical vulnerability affecting infrastructure that can sit directly between users and some of an organization's most important applications. F5 Big IP Access Policy Manager. The vulnerability is CVE-2026-94127. It is critical, it allows unauthenticated remote code execution. And most importantly, F5 says attackers have already exploited it. Here's what happened: CVE-2026-94127 is a heap-based buffer overflow affecting specific Big IP access policy manager deployments. The vulnerability exists when an APM access policy and an OAuth profile are configured on the same virtual server, with Big IPAPM operating as an OAuth authorization server. That configuration requirement matters. Deployments using APM strictly as an OAuth client or resource server without OAuth authorization server profiles configured are not affected by this vulnerability. For vulnerable systems, however, the impact is severe. An attacker does not need authentication. They do not need existing privileges. And they do not need a user to click anything. Specific malicious traffic sent to the vulnerable virtual server can trigger the flaw. And result in remote code execution. The vulnerability affects the data plane. F5 says there is no control plane exposure associated with the floor. But that does not make the vulnerability insignificant. The data plane is responsible for processing the traffic moving through the big IP system, and an attacker gaining code execution on infrastructure positioned at a critical access point can create serious consequences for confidentiality, integrity, and availability. The affected releases include Big IP 21.1.0, versions 17.5.0 through 17.5.1, and versions 17.1.0 through 17.1.3. F five has released fixes. CISA has also added CVE-2026-94127 to its known exploited vulnerabilities catalogue. Confirming evidence of active exploitation. For federal civilian agencies, the remediation deadline is September 25th. So, what should defenders do? First, determine whether your big IP environment actually meets the vulnerable configuration. Do not rely only on product inventory. Confirm whether an APM access policy and OAuth profile are configured on the same virtual server and whether APM is acting as an OAuth authorization server. Second, apply the appropriate F5 security update immediately. This is no longer a theoretical vulnerability. Attackers have already demonstrated that exploitation is possible in real environments. Third, if immediate patching is impossible, F5 has provided a mitigation involving an I-Rule that affected customers can obtain through F5 support. Fourth, hunt for evidence of compromise. F5 has published indicators defenders can use when investigating affected systems. One detection pattern involves correlating repeated OAuth authentication failures and suspicious command activity followed shortly afterward by a TMMSI-GABRT event. Those indicators should be investigated together rather than treated as definitive evidence individually. And finally, pay particular attention to internet-facing edge infrastructure, access gateways, VPN appliances, identity infrastructure, load balancers, and application delivery systems. These systems are attractive because they sit at a boundary attackers want to cross. The strategic lesson is important. Security teams cannot prioritize vulnerabilities using severity scores alone. A critical score tells you what could happen. Active exploitation tells you what attackers are already attempting to do. CVE-2026-94127 has both: critical technical impact, unauthenticated remote exploitation, and confirmed exploitation in the wild. If you operate affected F5 Big IPAPM infrastructure, identify the vulnerable configuration, patch it, investigate for compromise, and verify remediation. Because when an edge device becomes the attack surface, the security boundary itself can become the entry point. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.