Di week wey di identity issuer itself fall — F5 BIG-IP APM OAuth zero-day (CVE-2026-94127) and how KEV gather for management and identity planes
F5 disclose for 22 September say critical zero-day for BIG-IP APM OAuth path (CVE-2026-94127, CVSS 9.8) dey allow unauthenticated remote code execution, and dem confirm say exploitation dey happen for di wild. CISA add am to di KEV catalog di same day with federal deadline of 25 September. Arista VCO and two Check Point management-server flaws enter KEV dat day too — we dey look di way attacks gather on boundary appliances dem management and identity planes.
Dis article na machine translation.
For 22 September 2026, F5 disclose CVE-2026-94127 (internal ID 2524777) for BIG-IP Access Policy Manager (APM). When APM access policy and OAuth profile dey configured on virtual server, specific malicious traffic fit lead to remote code execution (RCE) — heap-based buffer overflow (CWE-122) — wey carry CVSS v3.1 score of 9.8 (as F5 report) and CVSS v4.0 of 9.3 (as F5 report, through NVD). Di flaw limit to deployments where BIG-IP APM dey configured as OAuth Authorization Server; deployments wey dey use APM strictly as Client / Resource Server no dey affected. F5 talk say dem sabi say dis vulnerability don dey exploited, and dem note say na for inside dem discover di defect. E be data-plane issue with no control-plane exposure, and BIG-IP for Appliance mode dey vulnerable too. Di affected releases na 21.1.0 (fixed in Hotfix-BIGIP-21.1.0.2.0.30.22-ENG), 17.5.0-17.5.1 (fixed in Hotfix-BIGIP-17.5.1.9.0.160.12-ENG), and 17.1.0-17.1.3 (fixed in Hotfix-BIGIP 17.1.3.5.0.41.14-ENG); BIG-IP Next, F5 Distributed Cloud, NGINX, and F5OS no dey affected (F5 advisory K000162605).
CISA add di vulnerability to im KEV catalog for 22 September, and give federal civilian agencies until 25 September to respond (BOD 26-04, three days from listing). E dey subject to forensic triage, and CISA KEV notes direct operators to apply di vendor-provided iRule as temporary mitigation, then install di final patch as soon as possible. F5 too dey offer iRule mitigation for di affected virtual server, wey dey available through F5 support. For compromise assessment, F5 publish three indicators of compromise, wey CERT-EU advisory (2026-013) arrange into four-step review: repeated OAuth authentication failures (invalid_token) for /var/log/apm, unexplained increase for total_failed through tmctl global_oauth_stat, suspicious commands for /var/log/audit around dose timestamps, and di TMM loop wey make di SOD daemon send SIGABRT (di presence of TMM core file alone no be indicator) — na di combination and frequency of dese wey correlate with attack (according to The Hacker News, CISA KEV catalog, and CERT-EU).
Analysis (wey we separate from facts): wetin deserve attention no be di single CVE pass di composition of di four entries wey land for di KEV catalog for 22 September: dis F5 BIG-IP APM flaw, plus Arista VeloCloud Orchestrator (CVE-2026-93952) and two Check Point management-server flaws (CVE-2026-93616 / CVE-2026-85102). Di common thread na say di «management and identity planes» of distributed network functions na di targets. Last week dis observatory cover di Cisco ISE management-API auth bypass (CVE-2026-76460) and di problem say logs of compromised appliance itself no dey primary source again. Dis case move dat one step further: where APM dey used as OAuth authorization server, di appliance itself effectively na di identity issuer, and unauthenticated RCE on im data plane carry di meaning of to capture di issuer itself. Di fact say F5 discover di defect inside suggest quiet in-the-wild exploitation window before disclosure; who dey do di exploiting still no dey public.
Wetin e mean for defense: (1) If you dey run BIG-IP APM as OAuth authorization server, apply di matching hotfix (or later release on di same branch) first. Deployments wey dey use APM strictly as client / resource server dey out of scope, but hybrid configurations wey include authorization-server profile need inventory per virtual server. (2) Where di iRule mitigation dey deployed before patching, record am as mitigation — according to CISA notes, as stopgap wey dem go pair with di final patch. (3) Run CERT-EU four-stage detection (OAuth-failure repetition, total_failed, audit logs, TMM core) on di appliance itself, and also review firewall / NetFlow history for traffic to APM, on di premise say di appliance own logs fit no be primary source again. (4) With di same lens, inventory di exposure of «management and identity plane» assets — Arista VCO and Check Point management servers included — alongside patching per CVE. Facts here draw on F5 advisory (https://my.f5.com/manage/s/article/K000162605), di CISA KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), di NVD CVE record (https://nvd.nist.gov/vuln/detail/CVE-2026-94127), CERT-EU advisory 2026-013 (https://cert.europa.eu/publications/security-advisories/2026-013/), The Hacker News (https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html), and SecurityWeek (https://www.securityweek.com/critical-f5-big-ip-vulnerability-exploited-as-zero-day/). Analysis dey kept separate from reporting.