Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)
Unauthenticated heap-based buffer overflow in F5 BIG-IP APM OAuth userinfo endpoint (CVE-2026-94127) enables remote code execution on edge appliances actively exploited in the wild. F5 BIG-IP APM's tmm64 process allocates a 0x4100-byte heap buffer for the Authorization header on OAuth endpoints but failed to validate header length before copying. An oversized Bearer token to /f5-oauth2/v1/userinfo overwrites an adjacent heap object containing a function pointer, enabling stack-pivot to ret2plt gadgets. SELinux blocks exec, so the exploit appends commands to a crash hook script at /etc/bigstart/scripts/tmm.finish for execution on next tmm64 restart.
Detection / Hunteropenrouter
Immediate Actions
- Apply F5 hotfix ISO for your affected BIG-IP APM version immediately.
- Restrict network access to BIG-IP APM OAuth endpoints to trusted sources only.
- Inspect /etc/bigstart/scripts/tmm.finish for unexpected appended commands.
- Review BIG-IP HTTP logs for oversized Authorization headers to OAuth endpoints.
Key Takeaways
- Affected versions: BIG-IP APM 21.1.0, 17.5.0–17.5.1, 17.1.0–17.1.3; only APM with OAuth profiles is vulnerable.
- Heap buffer of 0x4100 bytes allocated via umalloc; no size check on Authorization header before memcpy.
- No PIE on tmm64 binary; ASLR enabled but heap layout is deterministic ~90% of runs.
- SELinux enforcing blocks exec syscalls; exploit pivots to writing a web shell or appending to tmm.finish hook script.
- F5 advisory K000162605 published Sept 22; hotfix ISOs available for each affected branch.
Attack Chain
- Reconnaissance: Identify F5 BIG-IP APM with OAuth profile configured on a virtual server
- Initial Access: Send oversized Authorization Bearer header (>0x4100 bytes) to /f5-oauth2/v1/userinfo
- Exploitation: Heap overflow overwrites adjacent object function pointer at buffer+0x4ff8
- Execution: Stack pivot to ret2plt gadgets; open and write to /etc/bigstart/scripts/tmm.finish
- Trigger: Crash tmm64 process to execute tmm.finish hook with appended attacker commands
Affected Systems
- BIG-IP APM 21.1.0 (build 0.0.38)
- BIG-IP APM 17.5.0 through 17.5.1
- BIG-IP APM 17.1.0 through 17.1.3
- BIG-IP APM with OAuth profile and access policy on a virtual server
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-94127 | F5 BIG-IP APM (tmm64) OAuth Authorization Server | Critical | Heap-based buffer overflow in OAuth Authorization header handling allows unauthenticated remote code execution. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | F5 BIG-IP runs TMOS, a custom Linux appliance; standard EDR agents are typically not deployed. |
| Network Visibility | Medium | Oversized Authorization headers to OAuth endpoints are visible in HTTP traffic and WAF logs. |
| Detection Difficulty | Moderate | Oversized Authorization header is a clear signal but requires HTTP inspection of OAuth endpoints on the data plane. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| HTTP requests to /f5-oauth2/v1/* endpoints with Authorization headers exceeding 0x4100 bytes indicate exploitation of CVE-2026-94127 (T1190). | F5 HTTP logs, WAF logs, network IDS | Initial Access | Low — legitimate OAuth tokens rarely exceed 16KB. |
| Unexpected modifications to /etc/bigstart/scripts/tmm.finish on F5 BIG-IP appliances indicate post-exploitation persistence via crash hook (T1546). | F5 audit logs, file integrity monitoring | Persistence | Low — this script is not modified during normal operations. |
| Repeated tmm64 process crashes followed by execution of tmm.finish with new content indicate exploit-triggered restart loop (T1546). | F5 system logs, process monitoring | Execution | Medium — tmm64 crashes can occur from config errors. |
Required Log Sources
- F5 BIG-IP LTM/APM HTTP request logs
- Network IDS/IPS full-packet capture
- F5 BIG-IP audit logs
- F5 SELinux AVC denial logs
- Process crash logs on BIG-IP appliance
Key Behavioral Indicators
- Authorization header exceeding 0x4100 bytes sent to /f5-oauth2/v1/userinfo
- tmm64 process crash with corrupted heap metadata in ufree
- Unexpected content appended to /etc/bigstart/scripts/tmm.finish
- SELinux AVC denials for exec syscalls from tmm64 process
- Bearer token containing long repeated character sequences (e.g., 0x41)
Control Gaps
- WAF rules may not inspect Authorization header sizes on OAuth endpoints
- Network IDS signatures for this specific overflow pattern are not yet published
- File integrity monitoring may not cover /etc/bigstart/scripts/ on F5 appliances
- Standard EDR coverage does not extend to F5 TMOS appliances
False Positive Assessment
Low — oversized Authorization headers to OAuth userinfo endpoints are anomalous; legitimate OAuth Bearer tokens rarely exceed a few kilobytes.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Disable OAuth profiles on BIG-IP virtual servers if not actively required.
- Deploy WAF rule to block Authorization headers exceeding 16KB on F5 endpoints.
- Enforce network segmentation to limit exposure of BIG-IP management and data plane.
- Enable file integrity monitoring on /etc/bigstart/scripts/ directory.
User Protection
- Monitor tmm64 process crash events for repeated unexpected restarts.
- Enable F5 SELinux audit logging and review AVC denials from tmm64.
- Block outbound connections from BIG-IP appliances to untrusted destinations.
MITRE ATT&CK Mapping
Initial Access
Execution
Persistence
Privilege Escalation
Plain-Language Summary
A security flaw in F5's BIG-IP network appliance lets attackers take full control without a password. The flaw is in how the appliance handles OAuth login tokens — it copies an oversized security credential into a fixed-size memory buffer without checking the size first, corrupting nearby memory. Attackers can use this to run arbitrary commands on the appliance. F5 has released patches; organizations using BIG-IP APM with OAuth should apply the hotfix immediately and check for signs of exploitation.
Additional IOCs
- File Paths:
/etc/bigstart/scripts/tmm.finish- Legitimate F5 crash hook script abused for command execution on tmm64 restart
- Command Lines:
- Purpose: Append attacker command to tmm.finish crash hook script for execution on next tmm64 crash/restart | Tools:
open,write,ret2plt| Stage: Persistence/Execution |open("/etc/bigstart/scripts/tmm.finish", O_WRONLY | O_APPEND)
- Purpose: Append attacker command to tmm.finish crash hook script for execution on next tmm64 crash/restart | Tools:
- cveCVE-2026-94127Heap-based buffer overflow in OAuth Authorization header handling allows unauthenticated remote code execution.
- file_path/etc/bigstart/scripts/tmm.finishLegitimate F5 crash hook script abused for command execution on tmm64 restart
