Skip to content
Hermes Codex

CVE-2026-94127: F5 BIG-IP APM TMM Heap-Based Buffer Overflow Remote Code Execution

HERMES

HERMES THREAT SCORE & ENTERPRISE RISK EXPOSURE

Target: Reverse Proxy Ingress & OAuth Token Federation Boundary
Confidence: 98%
96 / 100
EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 20 / 20
Weaponization 20 / 20
Exposure 19 / 20
Prevalence 18 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 19 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-94127 at 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Hermes Threat Score assigns 96 (EXTREME). The vulnerability resides in the core data plane microkernel (TMM) of BIG-IP appliances. Because APM acts as the central reverse proxy and zero-trust authentication gateway for mission-critical enterprise environments, an unauthenticated heap corruption allows remote attackers to compromise high-throughput network appliances regardless of administrative lockdown.

HASS

HASS AGENTIC SEVERITY & PERIMETER BOUNDARY IMPACT

Target: Reverse Proxy Ingress & OAuth Token Federation Boundary
Confidence: 95%
58 / 100
MODERATE

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 15 / 20
Tool Access 16 / 20
Privilege 14 / 15
Persistence 13 / 15
External Impact 13 / 15
Propagation 13 / 15
⚖️ Divergence & Operational Rationale

F5 BIG-IP APM commonly enforces OAuth 2.0 and SAML tokens protecting access to agentic orchestration planes, AI inference APIs, and sensitive data lakes. Hijacking TMM grants adversaries cleartext access to all decrypted user queries, API keys, and corporate intelligence payloads before they reach agent runtimes.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-94127: F5 BIG-IP APM TMM Heap-Based Buffer Overflow Remote Code ExecutionVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTF5 BIG-IP TMOS
98% VERY_HIGH

Enterprise application delivery controller, SSL VPN, and traffic management proxy operating system (TMOS).

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in F5 BIG-IP Access Policy Manager documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”

The Traffic Management Microkernel (TMM) is the proprietary real-time operating system component executing in user space with direct hardware access on BIG-IP devices. It intercepts, decrypts, and inspects network packets at line rate before delegating application logic.

ParameterTechnical SpecificationOperational Impact
CVE IdentifierCVE-2026-94127F5 Security Advisory K000162605 / CISA KEV Record
Vulnerability ClassHeap-based Buffer Overflow (CWE-122)Unchecked memory copy during binary claim parsing
Vulnerable ComponentTraffic Management Microkernel (tmm) / APM OAuth ModuleData plane microkernel handling packet ingress and SSL termination
Trigger MechanismMalformed OAuth Bearer token in HTTP Authorization headerInteger truncation in claim size leading to heap slab overwrite
Privileges RequiredNone (PR:N)Attacker sends requests to any VIP configured with APM + OAuth
Privileges ObtainedRoot / TMM Context (uid=0 / microkernel control)Data plane hijacking, session interception, or appliance failure
Affected VersionsBIG-IP 21.1.0, 17.5.0, 17.1.0 (with APM and OAuth profile enabled)Hardware appliances and Virtual Editions (VE)
Fixed HotfixesHotfix-BIGIP-21.1.0.2.0.30.22-ENG, 17.5.1.9.0.160.12-ENG, 17.1.3.5.0.41.14-ENGRe-architects claim buffer length calculation and bounds checks

2. Vulnerability Anatomy & Root Cause Analysis

Section titled “2. Vulnerability Anatomy & Root Cause Analysis”

Integer Truncation and Unchecked Copy in parse_oauth_claims

Section titled “Integer Truncation and Unchecked Copy in parse_oauth_claims”

The flaw originates in TMM’s binary decoder responsible for parsing incoming OAuth 2.0 bearer tokens and JSON Web Tokens (JWT). When unpacking authorization claims, the parser calculates the memory required based on an unverified length field present in the token structure, while utilizing an unchecked memory copy from the raw network packet buffer:

// Vulnerable TMM token parsing logic (decompilation approximation)
int parse_oauth_claims(tmm_conn_t *conn, char *token_payload, uint32_t payload_len) {
    // 16-bit integer truncated from 32-bit input length
    uint16_t claim_size = *(uint16_t *)(token_payload + 4);
    char *heap_chunk = tmm_heap_alloc(claim_size);


    // VULNERABILITY: payload_len can exceed claim_size due to integer truncation
    // Overwrites adjacent tmm_conn_t control structures in the TMM slab allocator
    if (heap_chunk) {
        memcpy(heap_chunk, token_payload + 6, payload_len - 6);
        process_claims(heap_chunk);
    }
    return 0;
}

Because the memory allocation size is cast to an unsigned 16-bit integer (uint16_t), a payload length exceeding 65,535 bytes wraps around. For instance, a payload length of 65,540 bytes results in an allocation of only 4 bytes, followed by a memcpy() copying 65,534 bytes into the tiny heap chunk. This completely corrupts the adjacent memory pool in the TMM slab allocator, overwriting function pointers and connection tracking structures.

3. Attack Vectors & Forensic Execution Flow

Section titled “3. Attack Vectors & Forensic Execution Flow”
sequenceDiagram
    autonumber
    actor Attacker as Remote Attacker
    participant VIP as BIG-IP Virtual Server (APM VIP)
    participant TMM as Traffic Management Microkernel (TMM)
    participant Heap as TMM Slab Memory Allocator
    participant APM as APM OAuth Evaluation Engine
    participant Host as BIG-IP Underlying OS / Control Plane


    Attacker->>VIP: TLS handshake & HTTP GET /oauth/v1/auth (TCP 443)
    Note over Attacker,VIP: Authorization: Bearer <malformed_65KB_token>
    VIP->>TMM: Ingress packet dispatched to TMM worker thread
    TMM->>Heap: Allocate heap slab based on truncated 16-bit length (claim_size)
    Heap-->>TMM: Return small memory chunk pointer
    TMM->>Heap: memcpy() unchecked payload exceeding chunk boundaries
    Note over Heap: Heap corruption: overwrites adjacent connection & function pointers
    alt Control Flow Hijack
        TMM->>Host: Divert execution to attacker shellcode payload (Root / TMM)
        Host-->>Attacker: Ingress channel takeover & session interception
    else Microkernel Segfault
        TMM-->>Host: Trigger kernel panic / core dump -> TMM service restarts
        Note over Host: Failover triggered / Appliance Denial of Service
    end
  1. Target Virtual Server Identification: The attacker identifies an internet-facing or internal F5 BIG-IP virtual server configured with an Access Policy Manager (APM) policy enforcing OAuth 2.0 token validation.
  2. Crafting Overflow Bearer Token: The attacker constructs an oversized HTTP request containing a forged JWT / OAuth Bearer token in the Authorization header, formatting the inner payload so that the 16-bit claim size field truncates while total packet length exceeds 65 KB.
  3. Memory Allocation Mismatch: TMM receives the packet over the TLS connection and invokes parse_oauth_claims(). The microkernel allocates a small heap chunk matching the truncated integer value.
  4. Heap Overwrite & Slab Corruption: The unconstrained memcpy() executes, overwriting adjacent memory slabs including active connection context tables (tmm_conn_t) and function dispatch vectors.
  5. Payload Execution or Denial of Service: If crafted with precise memory alignment, the attacker achieves arbitrary code execution within the high-privilege TMM microkernel space; alternatively, the memory fault triggers an immediate TMM panic and crash loop, taking all virtual servers hosted on the chassis offline.

4. Forensic Investigation & Incident Response

Section titled “4. Forensic Investigation & Incident Response”

When investigating suspected exploitation of CVE-2026-94127 on F5 BIG-IP appliances, DFIR and network operations teams should inspect system health, process core files, and microkernel logs:

Appliance Triage & Memory Analysis Commands

Section titled “Appliance Triage & Memory Analysis Commands”
Terminal window
# 1. Check TMM daemon status and uptime
tmsh show sys service tmm


# 2. Search for TMM segmentation faults and crash dumps in system logs
grep -E "panic|segfault|tmm.*died|heap corruption" /var/log/tmm* /var/log/messages


# 3. List recent core files generated by crashed TMM instances
ls -lh /var/core/core.tmm*


# 4. Extract backtrace from core dump using gdb
gdb /usr/bin/tmm /var/core/core.tmm.0 -ex "bt" -ex "quit"


# 5. Inspect active APM access sessions for anomalous client tokens
tmsh show apm session


# 6. Audit memory allocation stats in the TMM slab allocator
tmctl memory_summary -s name,allocated,max_allocated

5. Threat Hunting & Detection Engineering

Section titled “5. Threat Hunting & Detection Engineering”

Deploy the following detection signatures across endpoint logging and network telemetry:

title: F5 BIG-IP APM TMM Crash or Abnormal Core Generation
id: 94127b02-f5-tmm-overflow-detect01
status: critical
description: Detects signs of TMM daemon heap corruption or unexpected core dump generation on F5 BIG-IP devices.
author: Hermes Codex Detection Engineering
date: 2026-09-22
logsource:
  category: application
  product: f5_bigip
detection:
  selection_tmm_log:
    file: '/var/log/tmm*'
    message|contains:
      - 'tmm: segfault at'
      - 'panic: tmm received signal'
      - 'TMM heap corruption detected'
      - 'assertion failed: claim_size'
  selection_core:
    file|startswith: '/var/core/'
    file|contains: 'core.tmm'
  condition: selection_tmm_log or selection_core
falsepositives:
  - Rare hardware memory errors or power faults causing TMM restarts.
level: critical
tags:
  - attack.impact
  - attack.t1499
  - cve.2026-94127

6. Remediation & Hardening Roadmap

Section titled “6. Remediation & Hardening Roadmap”

Official Security Hotfixes

Section titled “Official Security Hotfixes”

F5 has issued emergency engineering hotfixes documented in K000162605:

  • For BIG-IP 21.1.0: Install Hotfix-BIGIP-21.1.0.2.0.30.22-ENG or upgrade to patched maintenance train.
  • For BIG-IP 17.5.0: Install Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.
  • For BIG-IP 17.1.0: Install Hotfix-BIGIP-17.1.3.5.0.41.14-ENG.

Operational Mitigations & Defensive Hardening

Section titled “Operational Mitigations & Defensive Hardening”
  1. Disassociate OAuth Profile: If OAuth 2.0 authorization is not mandatory for virtual server operation, temporarily remove the OAuth profile from affected APM access policies.
  2. Upstream Request Size Restrictions: Configure upstream Web Application Firewalls (WAF) or ingress load balancers to drop incoming HTTP requests with Authorization headers exceeding 2,048 bytes.
  3. High Availability (HA) Failover Tuning: Ensure failover pairs have synchronized configurations and failover watchdogs enabled (bigstart status sod) to minimize service interruption should a TMM crash occur prior to patching.

7. Correlated Research & Internal References

Section titled “7. Correlated Research & Internal References”

Sources & References

Section titled “Sources & References”