The Week the Identity Issuer Itself Fell — F5 BIG-IP APM OAuth Zero-Day (CVE-2026-94127) and KEV's Concentration on the Management and Identity Planes

On September 22, 2026, F5 disclosed CVE-2026-94127 (internal ID 2524777) in BIG-IP Access Policy Manager (APM). When an APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE) — a heap-based buffer overflow (CWE-122) — carrying a CVSS v3.1 score of 9.8 (as reported by F5) and CVSS v4.0 of 9.3 (as reported by F5, via NVD). The flaw is limited to deployments where BIG-IP APM is configured as an OAuth Authorization Server; deployments using APM strictly as a Client / Resource Server are not affected. F5 states it is 'aware that this vulnerability has been exploited' and notes the defect was discovered internally. It is a data-plane issue with no control-plane exposure, and BIG-IP in Appliance mode is also vulnerable. The affected releases are 21.1.0 (fixed in Hotfix-BIGIP-21.1.0.2.0.30.22-ENG), 17.5.0-17.5.1 (fixed in Hotfix-BIGIP-17.5.1.9.0.160.12-ENG), and 17.1.0-17.1.3 (fixed in Hotfix-BIGIP 17.1.3.5.0.41.14-ENG); BIG-IP Next, F5 Distributed Cloud, NGINX, and F5OS are not affected (F5 advisory K000162605).

CISA added the vulnerability to its KEV catalog on September 22, giving federal civilian agencies until September 25 to respond (BOD 26-04, three days from listing). It is subject to forensic triage, and CISA's KEV notes direct operators to apply the vendor-provided iRule as a temporary mitigation, then install the final patch as soon as possible. F5 likewise offers an iRule mitigation for the affected virtual server, available through F5 support. For compromise assessment, F5 published three indicators of compromise, which CERT-EU's advisory (2026-013) organizes into a four-step review: repeated OAuth authentication failures (invalid_token) in /var/log/apm, an unexplained increase in total_failed via tmctl global_oauth_stat, suspicious commands in /var/log/audit around those timestamps, and the TMM loop that makes the SOD daemon send a SIGABRT (the presence of a TMM core file alone is not an indicator) — it is the combination and frequency of these that correlate with an attack (per The Hacker News, CISA's KEV catalog, and CERT-EU).

Analysis (separated from facts): what deserves attention is less the single CVE than the composition of the four entries that landed in the KEV catalog on September 22: this F5 BIG-IP APM flaw, plus Arista VeloCloud Orchestrator (CVE-2026-93952) and two Check Point management-server flaws (CVE-2026-93616 / CVE-2026-85102). Their common thread is that the 'management and identity planes' of distributed network functions are the targets. Last week this observatory covered the Cisco ISE management-API auth bypass (CVE-2026-76460) and the problem of a compromised appliance's own logs no longer being a primary source. This case advances that a step further: where APM is used as an OAuth authorization server, the appliance itself is effectively the identity issuer, and an unauthenticated RCE on its data plane carries the connotation of capturing the issuer itself. The fact that F5 discovered the defect internally suggests a quiet in-the-wild exploitation window before disclosure; the attribution of the exploiting party is not yet public.

Defensive implications: (1) If you run BIG-IP APM as an OAuth authorization server, apply the matching hotfix (or a later release on the same branch) first. Deployments using APM strictly as a client / resource server are out of scope, but hybrid configurations that include an authorization-server profile need a per-virtual-server inventory. (2) Where the iRule mitigation is deployed before patching, record it as a mitigation — per CISA's notes, as a stopgap to be paired with the final patch. (3) Run CERT-EU's four-stage detection (OAuth-failure repetition, total_failed, audit logs, TMM core) on the appliance itself, while also reviewing firewall / NetFlow history for traffic to APM, on the premise that the appliance's own logs may no longer be a primary source. (4) With the same lens, inventory the exposure of 'management and identity plane' assets — Arista VCO and Check Point management servers included — alongside per-CVE patching. Facts here draw on F5's advisory (https://my.f5.com/manage/s/article/K000162605), the CISA KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), the NVD CVE record (https://nvd.nist.gov/vuln/detail/CVE-2026-94127), CERT-EU advisory 2026-013 (https://cert.europa.eu/publications/security-advisories/2026-013/), The Hacker News (https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html), and SecurityWeek (https://www.securityweek.com/critical-f5-big-ip-vulnerability-exploited-as-zero-day/). Analysis is kept separate from reporting.