Exploited F5 BIG-IP RCE Vulnerability Details and PoC Disclosed

TL;DR

F5 Networks patched a critical zero-day flaw in its BIG-IP Access Policy Manager (APM). The vendor confirmed that this F5 BIG-IP RCE vulnerability is currently being exploited in the wild. Additionally, security researchers have publicly disclosed full technical details and a working proof-of-concept exploit. Administrators must update or mitigate immediately to prevent remote network compromise.

Why It Matters

BIG-IP APM serves as a central access proxy for corporate networks and APIs. Consequently, a zero-day flaw in this component allows attackers to bypass core security perimeters. F5 issued a stark warning in its advisory: “We have learned that this vulnerability has been exploited.”

An unauthenticated attacker can leverage this F5 BIG-IP RCE vulnerability to execute arbitrary commands. This capability leads to complete system takeover. The severity of the situation escalated when researchers from watchTowr published a detailed vulnerability analysis alongside a public PoC repository. The availability of weaponized code means that any unpatched system faces an imminent threat of intrusion.

How The Attack Works

The flaw, tracked as CVE-2026-94127, targets BIG-IP APM instances configured as OAuth Authorization Servers. The vulnerability stems from a basic heap-based buffer overflow in the C code handling OAuth requests.

When a client sends a request to the OAuth endpoint, the system allocates a 0x4100-byte heap buffer for the Authorization header. However, prior to the patch, the code did not verify if the supplied header actually fit inside this buffer. An attacker simply sends an HTTP GET request to the /f5-oauth2/v1/userinfo endpoint with a massive Authorization header exceeding 0x4100 bytes. The system blindly copies the oversized string, corrupting adjacent heap metadata and overwriting function pointers. To bypass SELinux restrictions, attackers use return-oriented programming (ROP) to append malicious commands to the /etc/bigstart/scripts/tmm.finish hook script, which executes automatically when the corrupted process crashes.

Affected Versions

This vulnerability impacts BIG-IP APM deployments that utilize OAuth Authorization Server profiles on a virtual server. The exploit targets systems running vulnerable versions, such as BIG-IP 21.1.0 (build 0.0.38). Deployments acting strictly as OAuth Clients or Resource Servers without authorization server profiles remain unaffected.

Patch Or Mitigation Steps

Administrators must install the latest F5 security updates immediately. For environments running version 21.1.0, apply hotfix build 0.30.22. If patching is not immediately feasible, you must apply the mitigating iRule provided by F5 Support to the affected virtual server. You should also review the official F5 security advisory and monitor your systems for multiple OAuth authentication failures followed by TMM SIGABRT crashes. Securing your access proxies is critical to stopping this active threat.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.