CVE-2026-94127 Elastic Security · Elastic

Detect F5 BIG-IP APM Heap-based Buffer Overflow (CVE-2026-94127) in Elastic Security

Detects exploitation attempts and post-exploitation activity targeting CVE-2026-94127, a heap-based buffer overflow (CWE-122) in the F5 BIG-IP Access Policy Manager (APM). The flaw allows a remote attacker to corrupt heap memory in the APM/TMM processing path, potentially achieving remote code execution or crashing the traffic management microkernel (TMM). Listed in CISA KEV with active exploitation. This detection surfaces anomalous APM authentication endpoint traffic, TMM crashes/restarts, unexpected process spawns from BIG-IP service accounts, and outbound connections from the appliance that indicate successful memory-corruption exploitation.

MITRE ATT&CK

Tactic
Initial Access Execution Impact

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=10m
  [ network where event.category == "network" and destination.port in (443, 8443) and url.path : ("/my.policy", "/vdesk/*", "/iControl/*", "/pre/*") and http.request.method == "POST" ]
  [ process where event.type == "start" and process.parent.name in ("tmm", "apmd", "httpd") and process.name in ("bash", "sh", "nc", "ncat", "python", "perl", "curl", "wget") ]
critical severity high confidence

Detects an anomalous child process (shell/network tool) spawned by a BIG-IP APM process shortly after a POST to APM endpoints — the classic memory-corruption-to-RCE sequence.

Data Sources

Endpoint process events (auditd/Elastic Agent on BIG-IP)Network flow logs

Required Tables

logs-endpoint.events.process-*logs-endpoint.events.network-*

False Positives & Tuning

  • Legitimate administrative scripts invoked by tmsh or iControl REST automation
  • Monitoring agents spawning helper processes from httpd
  • F5 support tooling (qkview) generating child processes

Other platforms for CVE-2026-94127

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulated oversized POST to APM logon endpoint

    Expected signal: APM access log entry showing a POST to /my.policy with an abnormally large request body from the tester source IP.

  2. Test 2Simulate TMM restart marker in syslog

    Expected signal: Syslog/TMM log line containing 'SIGSEGV' and 'TMM restarting' ingested by the SIEM.

  3. Test 3Simulate APM daemon spawning a shell

    Expected signal: Process-start event showing /bin/sh or bash spawned from a parent process emulating apmd/tmm/httpd.

Last updated: 2026-09-23 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the affected BIG-IP is running an APM-enabled configuration and cross-reference its software version against F5 advisory K000162605 to determine if it is in the vulnerable range.
  2. Review TMM logs (/var/log/tmm*, ltm) around the alert timeframe for segfault, core dump, or unexpected TMM restarts coinciding with the flagged source IP.
  3. Examine APM access logs (/var/log/apm) for the source IP: look for malformed or oversized POST bodies to /my.policy, /vdesk/, or iControl endpoints preceding any crash.
  4. Determine whether the source IP is internal, a known scanner, or an untrusted external host, and whether the appliance is internet-exposed.

Containment

  1. If exploitation is confirmed or strongly suspected, fail over to a standby BIG-IP or take the affected APM virtual server offline while patching.
  2. Apply the F5-provided fixed version per K000162605, or implement the vendor's interim mitigation (restrict management/APM access via self-IP port lockdown and iRules filtering).
  3. Block the identified source IP(s) at the perimeter and restrict APM virtual server access to known-good networks.

Evidence Collection

  1. Generate and preserve a qkview and collect /var/core/ TMM core files, /var/log/tmm*, /var/log/apm, and /var/log/ltm for forensic analysis.
  2. Capture full packet payloads of the suspicious POST requests (from WAF/IDS or tcpdump on the self-IP) to preserve the exploit primitive.

Escalation Criteria

  • !Escalate to incident response immediately if a shell, network tool, or outbound C2 connection is observed spawning from tmm/apmd/httpd on the appliance.
  • !Escalate if TMM core dumps recur or configuration/credential files (bigip.conf, master key, session DB) show signs of tampering or exfiltration.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >TMM core dump files in /var/core/
  • >APM access logs (/var/log/apm) and TMM logs (/var/log/tmm*)
  • >Unexpected cron entries, iRules, or modified bigip.conf indicating persistence
  • >New or modified files under /config and /var/tmp on the appliance

Tuning Guidance

Baseline normal APM POST volume per source IP over 30 days and set thresholds above the 99th percentile. Whitelist authorized vulnerability scanners and load-balancer health monitors by source IP. On appliances that legitimately restart TMM during maintenance, exclude change-window timeframes. Ensure BIG-IP is forwarding both apm and tmm syslog facilities so crash correlation works.

Hunting Queries

Hunt for source IPs generating anomalously high POST volume against APM endpoints, a precursor to fuzzing/exploitation.

Hunting — KQL
kql 
CommonSecurityLog | where DeviceVendor == "F5" | where RequestURL has_any ("/my.policy", "/vdesk/", "/iControl/") and RequestMethod == "POST" | summarize count() by SourceIP, bin(TimeGenerated, 1h) | where count_ > 50
Hunting — SPL
spl 
index=network sourcetype="f5:bigip:apm:syslog" ("my.policy" OR "/vdesk/" OR "/iControl/") POST | stats count by src_ip, host | where count > 50

Atomic Red Team Tests

Test 1 Simulated oversized POST to APM logon endpoint
linux

Sends an APM logon POST with an oversized field to generate the anomalous-request telemetry the detection keys on (does not exploit the vulnerability).

Command

bash 
curl -k -s -o /dev/null -X POST "https://$BIGIP_APM/my.policy" --data "username=$(python3 -c 'print(\"A\"*20000)')&password=test"

Cleanup

bash 
echo 'No cleanup required; no state persisted on the tester side.'

Expected Telemetry

APM access log entry showing a POST to /my.policy with an abnormally large request body from the tester source IP.

Expected Detection

KQL/SPL correlation flags the source IP for high-volume/anomalous POST activity against APM endpoints.

Test 2 Simulate TMM restart marker in syslog
linux

Injects a synthetic TMM segfault/restart log line into the BIG-IP syslog stream (lab only) to validate crash-correlation logic.

Command

bash 
logger -p local0.err -t tmm "notice tmm[12345]: 01010025:5: SIGSEGV received, core dumped, TMM restarting"

Cleanup

bash 
echo 'Log entry ages out per retention; no manual cleanup needed.'

Expected Telemetry

Syslog/TMM log line containing 'SIGSEGV' and 'TMM restarting' ingested by the SIEM.

Expected Detection

SPL/QRadar/Sumo crash-correlation rules increment the crash counter for the host.

Test 3 Simulate APM daemon spawning a shell
linux

Spawns a child shell under a parent named to mimic an APM daemon to validate the EQL/CQL process-lineage detection (lab host only).

Command

bash 
bash -c 'exec -a apmd sleep 30 & sleep 1; kill %1' ; setsid bash -c "echo simulated-apmd-child; /bin/sh -c id" &

Cleanup

bash 
pkill -f 'simulated-apmd-child' 2>/dev/null; echo done

Expected Telemetry

Process-start event showing /bin/sh or bash spawned from a parent process emulating apmd/tmm/httpd.

Expected Detection

Elastic EQL sequence and CrowdStrike CQL join fire on the anomalous BIG-IP-daemon-to-shell process lineage.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0040Impact

Related Techniques

T1190Exploit Public-Facing ApplicationT1499Endpoint Denial of ServiceT1059Command and Scripting Interpreter

Same Tactic: Initial Access

Popular Detections