Warning: Heap-based buffer overflow vulnerability in F5 BIG-IP Access Policy Manager (CVE)

* Vulnerability identifier: CVE-2026-94127, a heap-based buffer overflow in BIG-IP APM.
* Affected products and versions include BIG-IP APM 21 series (version 21.1.0) and 17 series (versions 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3).
* The vulnerability allows an unauthenticated remote attacker to execute arbitrary code if the product functions as an OAuth Authorization Server with access policies set on virtual servers.
* F5 reports that this vulnerability is being exploited.
* Detection involves checking log messages in "/var/log/apm" for "OAuth UserInfo request failure event" with log ID "01990004" appearing 10 or more times.
* Statistics on OAuth failures can be obtained by executing "tmctl globaloauthstat -s totalrequests,totaluserinforequests,totalfailed".
* Audit log messages in "/var/log/audit" should be checked for OAuth failure events during short periods.
* Generation of TMM core files is checked; loop states can lead to SIGABRT and core file generation.
* Manipulation of HTTP requests with abnormally long Authorization headers sent to "/f5-oauth2/v1/userinfo" is checked.
* The file "/etc/bigstart/scripts/tmm.finish" integrity is confirmed.

The narrative shifts the focus from a specific technical flaw in BIG-IP APM to an ongoing, sophisticated attack vector where legitimate operational logs are used as indicators of compromise. The framework outlined suggests that attackers leverage the application's internal processes—specifically related to OAuth handling and memory management (heap overflow)—to achieve remote code execution. The necessity of checking seemingly unrelated system files like TMM core files and audit logs demonstrates an adversarial assumption: that defenders will focus only on obvious application error messages while ignoring low-level system artifacts left by exploitation. This implies a pattern where control flow integrity is subtly broken, making the resulting system state observable only through deep forensic analysis rather than surface-level monitoring. The inclusion of watchTowr Labs' findings serves to contextualize this technical process as a real-world threat that necessitates proactive hunting across multiple system layers. The key implication for resilience lies in moving beyond simple signature matching to establishing anomalous baseline behaviors within the application's internal request/failure mechanisms, recognizing that legitimate operational noise can be deliberately intertwined with attack signals.
Bridge Questions: If systems are operating under an assumption of normal function while being compromised, where should the focus shift from monitoring event counts to monitoring the integrity of execution paths themselves? How can organizations establish baseline expectations for system calls and memory state so that deviations indicative of internal exploitation are recognized immediately without relying solely on predefined failure logs? What secondary artifacts (beyond explicit file writes) might a sophisticated attacker leave to signify successful control over a managed service like BIG-IP APM?