The F5 BIG-IP APM flaw: a 9.8-out-of-10 score, exploited before a fix even existed
Listen to the audio version
On September 22, 2026, vendor F5 released an emergency patch for a flaw identified as CVE-2026-94127, affecting its BIG-IP Access Policy Manager (APM) product. This flaw was actively exploited by attackers before F5 even disclosed its existence, making it what's called a zero-day: a vulnerability discovered while already being used in real-world attacks, before a fix exists to address it.
What BIG-IP APM actually is
BIG-IP APM is a product used by large organizations to manage access to their internal applications: it verifies a user's identity, enforces defined access rules, and often connects with single sign-on and two-factor authentication systems already described in the dedicated article. Concretely, it's a gateway placed in front of sensitive applications, whose exact role partially overlaps with that of a corporate VPN (see the article on VPNs): deciding who is allowed in, before letting traffic through to whatever sits behind it.
A product of this kind, deliberately placed at the border between the internet and an organization's internal network, becomes a particularly sought-after target: compromising it potentially means gaining direct access to whatever it was supposed to protect.
A memory overflow flaw, no credentials needed
The vulnerability is a heap-based buffer overflow, rated with a CVSS severity score of 9.8 out of 10, one of the highest scores possible. It occurs in how BIG-IP APM handles OAuth profiles, when an access policy and an OAuth profile are both configured on the same virtual server: processing certain attacker-supplied data then writes into a memory region without properly checking its size, overflowing into adjacent memory in a way that lets the flow of execution be hijacked to run arbitrary code.
The most serious detail is that no authentication is needed to exploit it: an attacker needs no valid credentials at all, only network access to a BIG-IP APM server configured this specific way. F5 notes that deployments using APM solely as an OAuth client or resource server, without an OAuth authorization server profile configured, are not affected, a technical distinction that reduces the number of systems actually exposed without eliminating it.
Why restricting admin access isn't enough here
F5 makes a point often misunderstood in this kind of advisory: this is a data plane issue, not a control plane one. In plain terms, restricting access to the BIG-IP's administrative interface, a basic security precaution otherwise always recommended, does nothing to reduce the real exposure: the flaw triggers through the normal traffic received by the affected virtual server, exactly the traffic it's supposed to receive continuously to function. A firewall placed in front (see the dedicated article) blocks nothing here either, since that traffic looks in every way like a legitimate request right up until the exact moment it exploits the flaw.
The response and the timeline
F5 released hotfixes for each affected version, along with an emergency iRule allowing organizations that can't patch immediately to mitigate the risk without waiting for a full update. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its catalog of actively exploited vulnerabilities, with a remediation deadline of September 25, 2026 for affected US federal agencies, just three days after public disclosure, an urgency that directly reflects the CVSS score and the confirmation of exploitation already underway.
What this episode is a reminder of
The affected versions (BIG-IP APM 17.1.0 through 17.1.3, 17.5.0 through 17.5.1, and 21.1.0) cover a large share of deployments still in service, often on systems considered stable and therefore rarely updated urgently, a habit already discouraged in the article on software updates. A component placed at the network edge, precisely because it's meant to filter and protect whatever sits behind it, becomes all the more critical to patch quickly, since a single flaw is enough to turn that protective role into a direct entry point inward.