CVE-2026-94127: Critical Hole in F5 BIG-IP APM Becomes an Unauthenticated Entry Point
Baca dalam 60 detik
- F5 mengonfirmasi kerentanan heap overflow pada BIG-IP APM yang memungkinkan eksekusi kode dari jarak jauh tanpa kredensial, dengan skor CVSS 9.8.
- Eksploitasi aktif terdeteksi, memicu CISA memasukkan CVE-2026-94127 ke katalog Known Exploited Vulnerabilities dan menetapkan tenggat perbaikan tiga hari bagi instansi federal AS.
- Organisasi di Indonesia yang menjalankan BIG-IP dengan konfigurasi APM dan OAuth profile wajib segera menambal atau menerapkan mitigasi iRule untuk mencegah kompromi pada lapisan data plane.
F5 Networks disclosed a critical vulnerability in the Access Policy Manager (APM) module of BIG-IP devices that allows attackers to execute code remotely without authentication. Tracked as CVE-2026-94127, the flaw has a CVSS score of 9.8 and strikes directly at the data plane layer of the Traffic Management Microkernel (TMM), not the management interface that is usually the target.
The vulnerability is only active under a specific configuration: a virtual server must run an APM access policy and an OAuth profile at the same time. The combination of those two features triggers a memory allocation failure in TMM, allowing an attacker to overwrite the heap and run arbitrary commands. F5 stressed that not all BIG-IP installations are affected, but organizations using that configuration pattern are at high risk. BIG-IP devices in appliance mode are also exposed, while versions that have reached End of Technical Support will not receive a patch.
F5 first confirmed the issue through advisory K000162872 on 2 September 2026, which stated the finding came from internal research. The Canadian Centre for Cyber Security also verified active exploitation in the field. In response, CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog on 22 September 2026. Under binding operational directive BOD 26-04, United States federal agencies are required to complete remediation within three calendar days, with a final deadline of 25 September 2026. The classification of the vulnerability as automatable and potentially causing total technical impact reinforces the urgency of that deadline.
This incident underscores a pattern of attacks targeting the trust layer of network infrastructure. Throughout September 2026, a number of high-profile security events occurred, from BlueMoon Patch-Gap, which highlighted the dangers of delayed remediation, and ADSys Trust-Store, which showed that authentication mechanisms can be abused, to flaws in SharePoint RCE and the Linux Kernel. CVE-2026-94127 targets the core engine that processes network traffic, in line with attacks on Cisco ISE and the Meta Muse macOS 0-Day. This pattern indicates attackers are systematically probing trust infrastructure to breach perimeter defenses.
For organizations in Indonesia, the risk cannot be ignored. Many companies and government agencies use F5 BIG-IP as the access gateway for internal applications and public services. According to cybersecurity observers, an APM configuration combined with an OAuth profile is commonly found in single sign-on (SSO) systems connected to cloud services. If not patched promptly, this flaw can become an entry point for attackers to take over devices and access sensitive data. The Personal Data Protection regulation (UU PDP), which has come into full force, requires organizations to safeguard data confidentiality; a failure to mitigate could lead to administrative sanctions and reputational damage.
The first step is to inventory all virtual servers to identify pairings of APM access policy and OAuth profile. F5 has released hotfixes for three version tracks: BIG-IP 21.1.0 (Hotfix-BIGIP-21.1.0.2.0.30.22-ENG), 17.5.x (Hotfix-BIGIP-17.5.1.9.0.160.12-ENG), and 17.1.x (Hotfix-BIGIP-17.1.3.5.0.41.14-ENG). If immediate patching is not possible, a temporary mitigation is available through an iRule that can protect virtual servers with the vulnerable configuration. Security teams are also advised to monitor indicators of compromise, especially suspicious command execution on devices.
“This vulnerability shows that complex security features can actually become a weak point if not managed properly,” said a cybersecurity analyst monitoring the case. He added that organizations need to act quickly because exploitation has already occurred.
With active exploitation and a federal mandate in place, remediation of CVE-2026-94127 must be prioritized. Organizations still running old versions without technical support should treat their systems as unprotected and consider migrating to a supported version. Looking ahead, the question is: will companies in Indonesia move quickly to patch this flaw, or wait for an incident to occur before acting?
