EUVD-2026-84427
GHSA-qppv-6jrg-hxq4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify BIG-IP virtual server with APM OAuth profile
-
DeliverySend crafted OAuth/APM data-plane request
-
ExploitTrigger heap buffer overflow (CWE-122)
-
ExecutionExecute arbitrary code on appliance
-
ImpactPivot into protected internal network
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target virtual server to have BOTH an APM (Access Policy Manager) access policy AND an OAuth profile configured - BIG-IP instances without APM or without an OAuth profile bound to a virtual server are not exploitable, which is the primary limiting factor. Where that configuration exists, no authentication, user interaction, or non-default hardening bypass is needed: it is remote, unauthenticated, low-complexity against the data plane, and Appliance mode does NOT mitigate it. This is a data-plane-only issue with no control-plane exposure. End-of-Technical-Support software versions were not evaluated by the vendor and their status is indeterminate. |
| Impact | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk paper tiger. The F5-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) describes network-reachable, low-complexity, unauthenticated remote code execution with full confidentiality, integrity, and availability impact - the maximal-severity profile for a perimeter device. The description and CWE-122 (heap-based buffer overflow) are internally consistent with RCE on the data plane, and F5 explicitly confirms Appliance mode (the hardened deployment) is also vulnerable, which removes a common mitigating assumption. The one meaningful risk-reducer is exposure gating: exploitation requires an APM access policy AND an OAuth profile bound to a virtual server, so instances not using APM/OAuth are not affected. No EPSS score, CISA KEV entry, or public POC is present in the provided data - so per the precision rules this is 'no public exploit identified at time of analysis.' That absence should not induce complacency: F5 BIG-IP RCEs are historically high-value targets that attract rapid exploit development and have a strong track record of KEV listing, so monitor for status changes. Note the input provides only a CVSS 4.0 vector (no 3.1 vector) and no SSVC decision data; those signals could not be cross-referenced. |
| Exploit ScenarioDerived | An unauthenticated attacker locates an internet-facing BIG-IP virtual server that has an APM access policy with an OAuth profile configured, then sends specially crafted data-plane traffic that triggers a heap buffer overflow in the OAuth/APM request-handling path. Because the flaw is pre-authentication and on the data plane, successful exploitation yields remote code execution on the appliance - even in the hardened Appliance mode. No public POC is identified at time of analysis, but the low attack complexity makes reliable weaponization plausible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 22, 2026
Remote code execution affects F5 BIG-IP systems that terminate traffic on a virtual server configured with both an APM (Access Policy Manager) access policy and an OAuth profile, where crafted malicious traffic can trigger a heap-based buffer overflow in the data plane. The flaw is remotely reachable, unauthenticated and low complexity per the vendor's CVSS 4.0 base score of 9.3, and the independent assessment confirms full confidentiality, integrity and availability impact (C:H/I:H/A:H) with no control-plane exposure; Appliance mode does not mitigate it. Exploitability is sharply limited by configuration - instances without APM or without an OAuth profile bound to a virtual server are not affected - and no public exploit code was identified at time of analysis, though the combination of unauthenticated RCE and a widely deployed enterprise appliance makes prompt hotfix deployment the priority.
Earlier versions of this analysis (1)
Remote code execution in F5 BIG-IP (CVSS 9.8) affects virtual servers configured with both an APM access policy and an OAuth profile; unauthenticated remote attackers can trigger a heap buffer overflow to execute arbitrary code on the data plane, and Appliance mode does not mitigate the flaw because it is a data-plane rather than control-plane issue. The attack requires no user interaction and has low complexity, though the APM+OAuth configuration is a strict prerequisite - if either feature is absent, the vulnerable code path is unreachable. No public exploit code has been identified at the time of analysis, but the severity and unauthenticated reachability make this a top-priority patch target.
RemediationAI
Apply the vendor hotfixes for the affected branches: upgrade BIG-IP 17.5.0 to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG or later, BIG-IP 17.1.0 to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG or later, and BIG-IP 21.1.0 to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG or later, per F5 advisory K000162605 at https://my.f5.com/manage/s/article/K000162605. Where immediate patching is not possible, the effective compensating control is to remove the exposure prerequisite: detach the OAuth profile from, or remove the APM access policy on, any virtual server that is not strictly required to perform OAuth/access-policy processing, understanding that this disables the corresponding authentication and single sign-on functionality for that virtual server and may break dependent applications; because the defect is reachable in the data plane, no control-plane restriction, network ACL on the management interface, or Appliance mode configuration mitigates it, so restricting internet-facing exposure of OAuth-enabled virtual servers is only a risk-reduction measure, not a fix. Note that End-of-Technical-Support BIG-IP versions have not been evaluated and receive no hotfixes, so those deployments must be upgraded to a supported branch rather than relying on a patch. No public exploit code was identified at time of analysis, but given unauthenticated remote code execution potential, treat remediation as urgent and monitor the advisory for updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-122, a heap-based buffer overflow, occurring in the BIG-IP data plane (TMM) rather than the control plane, meaning the vulnerable parsing path is exercised by traffic arriving at a virtual server, not by authenticated administrative configuration. The trigger conditions are the joint presence of an APM access policy and an OAuth profile on the same virtual server: OAuth-related request handling in that combined configuration performs insufficient bounds validation on attacker-influenced input, allowing an out-of-bounds heap write that can be leveraged toward code execution. The vendor CPE cpe:2.3:a:f5:big-ip:*:*:*:*:*:*:*:* maps the issue to the BIG-IP product line generically, with EUVD narrowing the affected builds to specific 17.5.x, 17.1.x and 21.1.x hotfix baselines, and the CVE is tracked in the EU CSIRT catalog as EUVD-2026-84427. Because the defect is memory-safety rather than an access-control or logic error, no authentication bypass or user interaction is required once the vulnerable configuration is reached, and the vendor explicitly notes that End-of-Technical-Support releases were not evaluated, leaving their exposure indeterminate.
Know when Big Ip gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable, low-complexity, unauthenticated RCE (PR:N/UI:N) yielding full code execution on the appliance; the required APM+OAuth config is a deployment precondition, not per-attack complexity, so AC stays L.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
Lifecycle Timeline
4DescriptionCVE.org
When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).
Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Articles & Coverage 1
Technical POC Analysis
CWE-122: heap-based buffer overflow.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A critical, remotely reachable flaw in F5 BIG-IP lets an unauthenticated attacker execute code on the data plane and gain full control of confidentiality, integrity, and availability on affected appliances. Only systems that terminate traffic on a virtual server configured with both an APM access policy and an OAuth profile are exposed, but those systems typically sit at the network edge and often carry authentication and application delivery functions for large user populations. Because no vendor patch is currently available and appliance mode provides no protection, leadership should treat this as an urgent, configuration-scoped risk requiring immediate narrowing of the exposed attack surface while a hotfix is obtained.
No vendor-released patch identified at time of analysis. Interim mitigations, all dependent on business acceptance: unbind the OAuth profile from, or disable the APM access policy on, affected virtual servers so traffic no longer reaches the vulnerable code path; take affected virtual servers out of service or restrict their network reachability to trusted source ranges where possible; enforce strict network segmentation so only intended clients can reach APM/OAuth-enabled virtual servers; enable and monitor data-plane logging for crash or anomalous-traffic indicators; and apply vendor-provided mitigation guidance from the F5 advisory as it is updated. Note that appliance mode does not mitigate this issue.
Threat Model
5 threats: Elevation of Privilege, Denial of Service, Tampering and 2 more
5-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges t
Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a r
Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor e
Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via
Traffic Management Microkernel (TMM) crash in F5 BIG-IP versions 16.1.0 through 21.0.0.1 allows unauthenticated remote a
Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles
F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when process
Remote memory exhaustion in F5 BIG-IP virtual servers crashes Traffic Management Microkernel when HTTP/2 Layer 7 DoS Pro
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are c
Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM)
Traffic Management Microkernel (TMM) in F5 BIG-IP terminates when processing specific traffic against UDP virtual server
Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust conn
Exploit-DB