CISA Orders Federal Agencies to Patch a Critical F5 BIG-IP Zero-Day by September 25

F5 has patched a critical, already-exploited zero-day in BIG-IP Access Policy Manager (APM), and the U.S. Cybersecurity and Infrastructure Security Agency has given federal civilian agencies until September 25 to respond, a three-day window from the day the flaw landed in its Known Exploited Vulnerabilities catalog. The bug, tracked as CVE-2026-94127, lets an unauthenticated attacker run code on a vulnerable BIG-IP system, and F5 says it discovered the security defect internally rather than through an outside researcher.

What CVE-2026-94127 Actually Does

APM, short for Access Policy Manager, is BIG-IP’s centralized access management module, the piece that decides whether a user is allowed to reach an organization’s networks, applications, cloud services, and APIs. The flaw only shows up in one specific setup: a BIG-IP APM access policy and an OAuth authorization server profile configured on the same virtual server, the configuration F5 uses when APM itself issues OAuth access tokens to other applications. BleepingComputer reports that deployments using APM strictly as an OAuth client or resource server, with no authorization server profile configured, are not affected.

Where the condition is met, specific malicious traffic sent to that virtual server triggers a heap-based buffer overflow (CWE-122) that can hand an attacker remote code execution with no login required. F5 rates the bug 9.8 out of 10 on CVSS v3.1 and 9.3 on CVSS v4.0. The Hacker News notes that because the malicious traffic targets the virtual server itself rather than the management plane, restricting access to the BIG-IP management interface does nothing to stop it. “The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure,” F5 wrote in its advisory.

F5 Narrowed the Scope After the Clock Was Already Running

One detail complicates an otherwise straightforward patch-now story. According to The Hacker News, F5 updated its own CVE record at 00:45 UTC on September 23, tightening the description so the flaw applies only when APM is acting in the authorization server role. CISA’s KEV entry and a separate advisory from CERT-EU, the cybersecurity service for European Union institutions, were both published before that update went out, and both describe the vulnerable condition more broadly: simply an access policy and an OAuth profile configured on a virtual server, without specifying which OAuth role triggers it.

In practice, that means organizations that assessed their exposure against the earlier, wider wording, including any that used CISA’s or CERT-EU’s own language to decide whether they were affected, were working from a definition F5 has since narrowed. Neither F5’s CVE record nor CISA’s KEV entry says how many systems have been attacked, who is behind the activity, or which organizations were targeted.

Which Versions Are Affected, and How to Patch

F5’s own configuration guide places the vulnerable setting under Access, then Federation, then OAuth Authorization Server, then OAuth Profile, attached to an access profile on the virtual server. Three branches carry the fix:

• 21.1.0, before the hotfix: fixed in Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
• 17.5.0 through 17.5.1, before the hotfix: fixed in Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
• 17.1.0 through 17.1.3, before the hotfix: fixed in Hotfix-BIGIP-17.1.3.5.0.41.14-ENG

F5 says no other products are affected, and it did not evaluate branches that have already reached End of Technical Support, so their status is unknown rather than confirmed safe. For administrators who cannot apply the engineering hotfix immediately, F5 is offering an iRule mitigation for the affected virtual server, available by opening a support ticket. CISA’s guidance to federal agencies is to apply that iRule first, “to allow for proactive forensic triage,” and then “install the final vendor patch as soon as possible.” CERT-EU’s advisory follows the same order: preserve forensic evidence, apply the hotfix, check for signs of compromise, and open an incident response if any are found.

The Warning Signs of Compromise

F5’s own indicators, relayed in CERT-EU’s advisory and reported by The Hacker News, center on one combination: repeated OAuth authentication failures, followed by suspicious commands, followed by a TMM process crash shortly after. Specifically:

• Repeated failed UserInfo requests in /var/log/apm carrying the error “The access token is invalid,” especially ten or more from a single IP address in a short window
• An unexplained rise in the total_failed counter when running tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed
• Suspicious commands in /var/log/audit around the same timestamps as the failed requests
• A TMM SIGABRT crash following those events; F5 notes that TMM core files alone are not proof of compromise, but are worth investigating in combination with the other signals

A Pattern F5 Customers Have Seen Before

This is not APM’s first appearance on CISA’s exploited-vulnerability list this year. An earlier APM flaw, CVE-2025-53521, was added to the KEV catalog in March, and its fixes for the 17.1 and 17.5 branches sit inside the version ranges this new flaw also affects. A system already updated to that March fix level still needs the new hotfix if it runs APM as an OAuth authorization server.

Internet-scanning nonprofit Shadowserver currently tracks more than 14,700 IP addresses carrying BIG-IP APM fingerprints exposed to the public internet, though there is no public data on how many of those have already been patched or are decoy honeypots. The disclosure also lands against a broader run of F5 security incidents: the company confirmed in October 2025 that state-sponsored hackers had breached its systems in August 2025 and stolen undisclosed BIG-IP source code and vulnerability details. Since November 2021, CISA has flagged eight actively exploited F5 vulnerabilities, four of which have also been abused in ransomware attacks.

F5 is a Fortune 500 company serving more than 23,000 customers worldwide, including 48 of the Fortune 50 and 80 percent of the Fortune Global 500, which is part of why an unauthenticated RCE bug in one of its most widely deployed access control modules draws a federal deadline measured in days rather than weeks. Organizations running BIG-IP APM as an OAuth authorization server should check their virtual server configuration against the version table above today, not after the September 25 deadline passes.