1.0 Introduction
A critical vulnerability (CVE-2026-94127) has been observed in the F5 BIG-IP product that could be exploited to execute malicious code on vulnerable systems. F5 has confirmed that the vulnerability has been exploited. The F5 BIG-IP Access Policy Manager (APM) contains a heap-based buffer overflow that allows an unauthenticated attacker with network access to a virtual server to execute arbitrary code. The vulnerability is present when a BIG-IP APM access policy and an OAuth profile are configured on the same virtual server, meaning APM is set up as an OAuth Authorization Server. It is not present in the default configuration. Deployments that use APM only as an OAuth client or resource server are not affected. BIG-IP systems in Appliance mode are also vulnerable.
2.0 Impact
Successful exploitation could allow a threat actor to
execute arbitrary code on the BIG-IP system by sending specially crafted
traffic to the affected virtual server. Because the traffic goes to the virtual
server itself, restricting access to the management interface does not protect
against this vulnerability. As BIG-IP systems often sit at the network edge, a
compromise may lead to full control of the device and access to the internal
network.
3.0 Affected Product
- BIG-IP APM version 21.1.0
- BIG-IP APM version 17.5.0
- 17.5.1
- BIG-IP APM version 17.1.0
- 17.1.3
4.0 Recommendations
CyberSecurity Malaysia recommends applying the F5 hotfix for
the affected version as soon as possible:
- Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso3
- Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso3
- Hotfix-BIGIP 17.1.3.5.0.41.14-ENG.iso3
If the hotfix cannot be applied immediately, F5 provides an
iRule mitigation for the affected APM virtual server, available through F5
Support. Administrators should also check whether any virtual server has both
an APM access policy and an OAuth profile, and review systems for signs of
compromise. F5 advises looking for multiple OAuth authentication failures and
suspicious commands followed by a TMM SIGABRT.
Kindly refer to the following URL:
Generally, we advise users to be updated with the latest
security announcements by the vendor and follow best practice security policies
to determine which updates should be applied.
For further enquiries, please contact Cyber999 Incident
Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://my.f5.com/manage/s/article/K000162605
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog