Critical F5 BIG-IP APM OAuth Zero-Day Allows Remote Code Execution Without Login

CVE-2026-94127 is a critical remote code execution flaw in F5 BIG-IP Access Policy Manager (APM) that allows an unauthenticated attacker to execute arbitrary code on the BIG-IP system. The vulnerability is specific to deployments where APM is configured as an OAuth 2.0 authorization server, the component responsible for issuing and validating access tokens to clients and resource servers.

OAuth servers are security-critical infrastructure. When compromised, they become a point of leverage for attackers to forge tokens, impersonate users, or pivot into downstream applications that trust tokens issued by the compromised server. Organizations running BIG-IP as a central identity broker face elevated risk because a single compromise affects every application relying on that OAuth provider.

The flaw affects F5 BIG-IP Access Policy Manager only when APM is actively serving as an OAuth authorization server. Not all BIG-IP deployments use APM in this role; many organizations use BIG-IP as a load balancer or reverse proxy without OAuth functionality. However, for those that do, the vulnerability affects multiple versions of BIG-IP, and the scope depends on the engineering hotfixes F5 has released.

F5 documented the affected versions in its advisory published on September 22. Administrators should cross-check their BIG-IP version and APM configuration against that advisory. If your organization uses BIG-IP in a different capacity (load balancing only, SSL termination, application acceleration), you may not be directly impacted, but it remains worth verifying your deployment topology.

The vulnerability allows an attacker to send a specially crafted request to the BIG-IP APM OAuth server that bypasses authentication checks and triggers code execution. Because the flaw operates at the application layer (in the OAuth service itself, not the underlying OS), it does not require the attacker to have network access to internal management interfaces. An attacker on the public internet can exploit it if the OAuth server is internet-facing or accessible from a compromised network segment.

The exact technical details of the flaw were not disclosed in public advisories to prevent widespread weaponization before patches were deployed. However, the attack surface is the OAuth endpoint itself, which means any organization exposing a BIG-IP OAuth service should treat this as an urgent priority. Attackers do not need valid credentials, and they do not need to interact with a user.

In a real-world scenario, an attacker would identify a BIG-IP APM OAuth server (often discoverable via DNS or SSL certificate enumeration) and send a malicious HTTP request to the OAuth endpoint. If the system is unpatched, the request triggers code execution on the BIG-IP system with the privileges of the APM process. From there, an attacker could establish persistence, exfiltrate configuration files containing OAuth client secrets, issue fraudulent tokens, or move laterally into the internal network.

The appeal of this vulnerability to attackers is that it offers a direct path into identity infrastructure without requiring password spraying, phishing, or social engineering. OAuth servers often sit in network zones considered low-risk and highly available, making them attractive targets.

If you operate F5 BIG-IP with APM, prioritize the following steps:

1. Verify whether your BIG-IP deployment includes APM and is configured as an OAuth authorization server. Check your BIG-IP configuration and network documentation.
2. Cross-reference your BIG-IP version and APM version against F5's advisory to confirm whether your system is affected.
3. Review F5's engineering hotfixes and deployment instructions. Hotfixes may require scheduling a maintenance window and may have prerequisites.
4. If applying the patch immediately is not possible, implement network-level mitigations such as restricting access to the OAuth endpoint to known internal clients, or placing the endpoint behind a WAF with additional validation rules.
5. Monitor BIG-IP logs for suspicious requests to the OAuth endpoint, particularly requests that trigger HTTP 5xx errors or show unusual request patterns.
6. Audit recent OAuth tokens issued by the system to detect any tokens issued to unexpected applications or users.

OAuth and similar identity protocols are complex, and implementing them securely in a load-balancing or application-delivery appliance adds layers of state management, token parsing, and cryptographic operations. Vulnerabilities arise when input validation or request parsing logic fails to properly sanitize or validate untrusted data before passing it to code execution functions.

F5 BIG-IP is a high-value target for security research because it sits at network perimeters and handles sensitive functions. When zero-days are found, they often affect a broad installed base. The fact that F5 released patches quickly indicates the company takes these risks seriously, but the window between public disclosure and patch deployment is always a period of elevated risk for unpatched systems.

This vulnerability reinforces several practical security principles. First, identity and authentication infrastructure deserves the same patching cadence as internet-facing applications, not the slower cycles often applied to "infrastructure" components. Second, OAuth and similar identity services should be monitored with the same scrutiny as application servers, including log analysis and anomaly detection for token issuance.

Third, network segmentation and access controls around identity servers add a layer of defense even if the identity server itself is compromised. If an OAuth server is broken into but access to it is already restricted to specific IP ranges or clients, the damage is limited. Finally, maintain an inventory of which internal systems depend on a particular identity provider, so that if a compromise occurs, you know which applications need re-authentication and trust re-establishment.

Begin with a factual assessment: does your organization run F5 BIG-IP, and if so, is APM configured as an OAuth server. If yes, immediately retrieve F5's advisory, identify your exact version, and determine whether you are affected. Contact your F5 support team or check F5's downloads portal for the hotfix relevant to your version. Schedule the patch during a controlled maintenance window and verify after deployment that OAuth functionality continues to work as expected. Set a reminder to review your BIG-IP and APM patch schedule quarterly to prevent similar gaps in the future.

Source: The Hacker News