Analysis of a pre-auth RCE in F5 BIG-IP: heap overflow via the Authorization header

watchTowr researchers have published a technical breakdown of the critical vulnerability CVE-2026-94127 in F5 BIG-IP — an unauthenticated heap overflow that leads to remote code execution (RCE) on the device. F5 confirmed that the vulnerability was exploited as a zero-day before a patch was available, and on September 22 it was added to the CISA KEV catalog. The CVSSv4.0 score is 9.3.

What F5 BIG-IP APM is BIG-IP is F5's line of network appliances (load balancers, access gateways, ADCs) that sit at the perimeter of many large organizations. The Access Policy Manager (APM) module handles authentication and access control and, in particular, can act as an OAuth server. It is precisely in this role that the problem lies.

Root cause The bug is in the handling of the HTTP Authorization header at the /f5-oauth2/v1/userinfo endpoint inside the tmm process (Traffic Management Microkernel). The code allocates a fixed 0x4100-byte buffer on the heap but does not check the length of the incoming header before copying it. F5's patch adds exactly this check — if (v20 > 0x4100) with the error "Authorization header too big"; the vulnerable versions lack it, so an over-long header is copied past the buffer boundary.

A single unauthenticated request is enough to trigger it: GET /f5-oauth2/v1/userinfo HTTP/1.1 Authorization: Bearer AAAA… (longer than 0x4100 bytes)

From overflow to code execution watchTowr took the chain all the way to full RCE: • the overflow corrupts heap metadata; in roughly 90% of runs, an object holding a function pointer lands nearby (at offset buffer + 0x4ff8); • after overwriting this pointer, the researchers hijacked control flow through the mov r9, [rdi]; call r9 gadget, and then used stack-pivot gadgets to build a ROP chain for code execution; • they bypassed the SELinux restriction on directly spawning a shell by appending commands to the crash-hook script /etc/bigstart/scripts/tmm.finish — these run when the tmm process restarts.

Who is affected • The vulnerability is NOT present in the default configuration: it requires a virtual server that has both an APM access policy and an OAuth authorization server profile configured. An indirect sign of a potentially vulnerable host is an exposed /f5-oauth2/v1/userinfo endpoint. • Affected branches are BIG-IP 21.1.0, 17.5.x and 17.1.x prior to the respective hotfixes (Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, -17.5.1.9.0.160.12-ENG, -17.1.3.5.0.41.14-ENG). A public PoC had not been confirmed at the time of publication. For those who cannot patch immediately, F5 offers a workaround via an iRule.

What it means for pentesters F5 BIG-IP is a classic high-value perimeter target: a compromise gives an initial foothold in the internal network and access to the traffic passing through it. • a pre-auth RCE achievable with a single request, with no authentication prerequisites, is exactly what should be checked on the external perimeter first; • the marker to look for is an exposed /f5-oauth2/v1/userinfo endpoint; • the vulnerability is already in the CISA KEV and is being exploited in the wild: for blue teams it is a priority for applying the hotfixes, and for red teams it is a current initial-access vector.