F5 BIG-IP APM Heap-based Buffer Overflow (CVE-2026-94127)

// F5 BIG-IP APM heap overflow exploitation (CVE-2026-94127) via TMM crash + anomalous APM POSTs
let apmEndpoints = dynamic(["/my.policy", "/vdesk/", "/pre/", "/tmui/", "/iControl/", "/mrhInclude", "/vdesk/hangup.php3"]);
let suspiciousUA = dynamic(["curl", "python-requests", "Go-http-client", "libwww-perl", ""]);
CommonSecurityLog
| where DeviceVendor == "F5" or DeviceProduct has_any ("BIG-IP", "APM", "ASM")
| where RequestURL has_any (apmEndpoints)
| where RequestMethod == "POST"
| extend BodyLen = toint(column_ifexists("RequestClientApplication", "")), ua = tostring(RequestClientApplication)
| where DeviceCustomString1 has_any ("overflow", "segfault", "TMM", "reset") or AdditionalExtensions has "heap"
| summarize Requests = count(), DistinctURLs = dcount(RequestURL), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DeviceProduct
| where Requests > 5
| order by Requests desc

index=network (sourcetype="f5:bigip:apm:syslog" OR sourcetype="f5:bigip:ltm:syslog" OR vendor="F5")
| eval is_crash=if(match(_raw, "(?i)(tmm.*(segfault|SIGSEGV|core dumped|panic|restart)|heap.*overflow)"), 1, 0)
| eval is_apm_post=if(match(_raw, "(?i)(POST).*(\/my\.policy|\/vdesk\/|\/pre\/|\/iControl\/)"), 1, 0)
| stats sum(is_crash) as crashes, sum(is_apm_post) as apm_posts, count as total, values(src_ip) as src_ips, min(_time) as first_seen, max(_time) as last_seen by host
| where crashes > 0 AND apm_posts > 3
| convert ctime(first_seen) ctime(last_seen)
| sort - crashes

sequence by host.name with maxspan=10m
  [ network where event.category == "network" and destination.port in (443, 8443) and url.path : ("/my.policy", "/vdesk/*", "/iControl/*", "/pre/*") and http.request.method == "POST" ]
  [ process where event.type == "start" and process.parent.name in ("tmm", "apmd", "httpd") and process.name in ("bash", "sh", "nc", "ncat", "python", "perl", "curl", "wget") ]

SELECT sourceip, destinationip, "URL" AS url, "Request Method" AS method, COUNT(*) AS cnt, MIN(starttime) AS first_seen, MAX(starttime) AS last_seen FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%F5%' AND ("URL" ILIKE '/my.policy%' OR "URL" ILIKE '/vdesk/%' OR "URL" ILIKE '/iControl/%') AND "Request Method" = 'POST' AND (QIDNAME(qid) ILIKE '%TMM%' OR payload ILIKE '%segfault%' OR payload ILIKE '%heap%' OR payload ILIKE '%overflow%') GROUP BY sourceip, destinationip, url, method HAVING cnt > 5 ORDER BY cnt DESC LAST 24 HOURS

_sourceCategory=*f5* OR _sourceCategory=*bigip*
| where _raw matches /(?i)(my\.policy|\/vdesk\/|\/iControl\/|\/pre\/)/
| where _raw matches /(?i)POST/
| if (_raw matches /(?i)(tmm.*(segfault|SIGSEGV|core dumped|restart)|heap.*overflow)/, 1, 0) as is_crash
| parse regex "(?<src_ip>\d+\.\d+\.\d+\.\d+)" nodrop
| count as events, sum(is_crash) as crashes, min(_messagetime) as first_seen, max(_messagetime) as last_seen by src_ip, _sourceHost
| where crashes > 0 and events > 3
| sort by crashes

rule f5_bigip_apm_heap_overflow_cve_2026_94127 {
  meta:
    author = "Argus Detection Platform"
    description = "F5 BIG-IP APM heap overflow exploitation (CVE-2026-94127)"
    severity = "HIGH"
    cve = "CVE-2026-94127"
  events:
    $e.metadata.vendor_name = "F5"
    $e.network.http.method = "POST"
    re.regex($e.target.url, `(?i)(/my\.policy|/vdesk/|/iControl/|/pre/)`)
    re.regex($e.metadata.description, `(?i)(tmm|segfault|heap|overflow|reset)`)
    $e.principal.ip = $src
  match:
    $src over 10m
  condition:
    #e > 5
}

#event_simpleName=/^(ProcessRollup2|NetworkConnectIP4)$/
| in(field="ImageFileName", values=["*/tmm", "*/apmd", "*/httpd"], ignoreCase=true)
| join({#event_simpleName=ProcessRollup2 | in(field="ParentBaseFileName", values=["tmm", "apmd", "httpd"]) | in(field="ImageFileName", values=["*/bash","*/sh","*/nc","*/ncat","*/python*","*/perl","*/curl","*/wget"])}, field=[aid], include=[ImageFileName, CommandLine, ParentBaseFileName])
| groupBy([aid, ComputerName, ParentBaseFileName, ImageFileName], function=count())
| sort(_count, order=desc)