CVE-2026-94127 — F5 BIG-IP APM Detection Tool (Defensive)

Author: https://github.com/FurkanKAYAPINAR/

A defensive, non-exploit detector for CVE-2026-94127, a heap-based buffer overflow (CWE-122) in F5 BIG-IP APM that allows an unauthenticated remote attacker to achieve remote code execution (RCE).

• CVSS 3.1: 9.8 / CVSS 4.0: 9.3 (Critical)
• Actively exploited in the wild — listed in the CISA KEV catalog.
• F5 advisory K000162605, published 2026-09-22.
• CISA federal remediation deadline: 2026-09-25.

This repository contains detection and remediation tooling only. It does not contain a weaponized exploit or proof-of-concept for achieving code execution. See Scope & ethics.

What the vulnerability requires

The vulnerability only manifests when BIG-IP APM is configured as an OAuth Authorization Server — that is, a virtual server that has both:

1. an APM access policy, and
2. an OAuth profile

Malicious OAuth traffic to such a virtual server can trigger the heap overflow. Deployments that use APM strictly as an OAuth Client / Resource Server (no authorization-server profile) are not affected.

What this tool does

detect_cve_2026_94127.py performs read-only checks:

1. Fingerprint (unauthenticated): determines whether a host is a BIG-IP / TMUI endpoint.
2. Version (authenticated): reads Version/Build via iControl REST (/mgmt/tm/sys/version) and compares against the affected ranges.
3. Preconditions (authenticated): checks whether any virtual server carries both an APM access policy and an OAuth profile.
4. Verdict: prints a clear verdict for each target.

It sends only normal, read-only requests — no crafted/overflow traffic.

Affected versions

F5's engineering hotfix versioning is irregular; the tool flags affected branches conservatively and tells you to confirm the exact fixed build against the official advisory before concluding.

Installation

pip install -r requirements.txt

Requires Python 3.8+.

Usage

# Unauthenticated fingerprint (is this a BIG-IP?)
./detect_cve_2026_94127.py -t 10.0.0.1

# Authenticated, read-only — most accurate (a read-only account is enough)
./detect_cve_2026_94127.py -t 10.0.0.1 -u admin        # prompts for password

# Scan a list of hosts and emit JSON
./detect_cve_2026_94127.py --targets-file hosts.txt -u admin --json

# Run on the appliance itself (uses tmsh), or against an exported config
./detect_cve_2026_94127.py --local
./detect_cve_2026_94127.py --config-file ./bigip.conf

Exit code is 2 when any target is vulnerable/likely-vulnerable (CI-friendly), 0 otherwise.

Verdicts

Remediation

1. Apply the F5 hotfix for your branch (see K000162605).
2. Interim mitigation: apply F5's vendor-provided iRule to affected virtual servers and enable enhanced logging for forensic triage.
3. Restrict network access to affected virtual servers until patched.
4. Review whether the OAuth Authorization Server role is required; disabling it removes the exploit precondition.

Scope & ethics

This project is intended for authorized defenders and administrators to inventory and remediate their own exposure ahead of the remediation deadline.

• Only run it against systems you own or are explicitly authorized to assess.
• It contains no exploit code. Because this CVE was patched only recently and is under active mass exploitation against a largely unpatched population, a public weaponized PoC would primarily enable attacks against victims; this repo deliberately omits one.

References

• F5 advisory: https://my.f5.com/manage/s/article/K000162605
• CVE record: https://www.cve.org/CVERecord?id=CVE-2026-94127
• Rapid7: https://www.rapid7.com/db/vulnerabilities/cve-2026-94127/

License

MIT — see LICENSE.