Detect F5 BIG-IP APM Heap-based Buffer Overflow (CVE-2026-94127) in CrowdStrike LogScale
Detects exploitation attempts and post-exploitation activity targeting CVE-2026-94127, a heap-based buffer overflow (CWE-122) in the F5 BIG-IP Access Policy Manager (APM). The flaw allows a remote attacker to corrupt heap memory in the APM/TMM processing path, potentially achieving remote code execution or crashing the traffic management microkernel (TMM). Listed in CISA KEV with active exploitation. This detection surfaces anomalous APM authentication endpoint traffic, TMM crashes/restarts, unexpected process spawns from BIG-IP service accounts, and outbound connections from the appliance that indicate successful memory-corruption exploitation.
MITRE ATT&CK
- Tactic
- Initial Access Execution Impact
LogScale Detection Query
#event_simpleName=/^(ProcessRollup2|NetworkConnectIP4)$/
| in(field="ImageFileName", values=["*/tmm", "*/apmd", "*/httpd"], ignoreCase=true)
| join({#event_simpleName=ProcessRollup2 | in(field="ParentBaseFileName", values=["tmm", "apmd", "httpd"]) | in(field="ImageFileName", values=["*/bash","*/sh","*/nc","*/ncat","*/python*","*/perl","*/curl","*/wget"])}, field=[aid], include=[ImageFileName, CommandLine, ParentBaseFileName])
| groupBy([aid, ComputerName, ParentBaseFileName, ImageFileName], function=count())
| sort(_count, order=desc)CrowdStrike CQL (LogScale) query detecting shell/network-tool child processes spawned by BIG-IP APM daemons (tmm/apmd/httpd) — the memory-corruption-to-RCE pivot for CVE-2026-94127.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate tmsh/iControl automation spawning helper scripts
- F5 diagnostic tooling (qkview) child processes
- Vendor support sessions running interactive shells
Other platforms for CVE-2026-94127
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated oversized POST to APM logon endpoint
Expected signal: APM access log entry showing a POST to /my.policy with an abnormally large request body from the tester source IP.
- Test 2Simulate TMM restart marker in syslog
Expected signal: Syslog/TMM log line containing 'SIGSEGV' and 'TMM restarting' ingested by the SIEM.
- Test 3Simulate APM daemon spawning a shell
Expected signal: Process-start event showing /bin/sh or bash spawned from a parent process emulating apmd/tmm/httpd.
References (4)
- https://my.f5.com/manage/s/article/K000162605
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-94127
Response Playbook
Triage
- Confirm the affected BIG-IP is running an APM-enabled configuration and cross-reference its software version against F5 advisory K000162605 to determine if it is in the vulnerable range.
- Review TMM logs (/var/log/tmm*, ltm) around the alert timeframe for segfault, core dump, or unexpected TMM restarts coinciding with the flagged source IP.
- Examine APM access logs (/var/log/apm) for the source IP: look for malformed or oversized POST bodies to /my.policy, /vdesk/, or iControl endpoints preceding any crash.
- Determine whether the source IP is internal, a known scanner, or an untrusted external host, and whether the appliance is internet-exposed.
Containment
- If exploitation is confirmed or strongly suspected, fail over to a standby BIG-IP or take the affected APM virtual server offline while patching.
- Apply the F5-provided fixed version per K000162605, or implement the vendor's interim mitigation (restrict management/APM access via self-IP port lockdown and iRules filtering).
- Block the identified source IP(s) at the perimeter and restrict APM virtual server access to known-good networks.
Evidence Collection
- Generate and preserve a qkview and collect /var/core/ TMM core files, /var/log/tmm*, /var/log/apm, and /var/log/ltm for forensic analysis.
- Capture full packet payloads of the suspicious POST requests (from WAF/IDS or tcpdump on the self-IP) to preserve the exploit primitive.
Escalation Criteria
- !Escalate to incident response immediately if a shell, network tool, or outbound C2 connection is observed spawning from tmm/apmd/httpd on the appliance.
- !Escalate if TMM core dumps recur or configuration/credential files (bigip.conf, master key, session DB) show signs of tampering or exfiltration.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
TMM core dump files in /var/core/ - >
APM access logs (/var/log/apm) and TMM logs (/var/log/tmm*) - >
Unexpected cron entries, iRules, or modified bigip.conf indicating persistence - >
New or modified files under /config and /var/tmp on the appliance
Tuning Guidance
Baseline normal APM POST volume per source IP over 30 days and set thresholds above the 99th percentile. Whitelist authorized vulnerability scanners and load-balancer health monitors by source IP. On appliances that legitimately restart TMM during maintenance, exclude change-window timeframes. Ensure BIG-IP is forwarding both apm and tmm syslog facilities so crash correlation works.
Hunting Queries
Hunt for source IPs generating anomalously high POST volume against APM endpoints, a precursor to fuzzing/exploitation.
CommonSecurityLog | where DeviceVendor == "F5" | where RequestURL has_any ("/my.policy", "/vdesk/", "/iControl/") and RequestMethod == "POST" | summarize count() by SourceIP, bin(TimeGenerated, 1h) | where count_ > 50index=network sourcetype="f5:bigip:apm:syslog" ("my.policy" OR "/vdesk/" OR "/iControl/") POST | stats count by src_ip, host | where count > 50Atomic Red Team Tests
Sends an APM logon POST with an oversized field to generate the anomalous-request telemetry the detection keys on (does not exploit the vulnerability).
Command
curl -k -s -o /dev/null -X POST "https://$BIGIP_APM/my.policy" --data "username=$(python3 -c 'print(\"A\"*20000)')&password=test"Cleanup
echo 'No cleanup required; no state persisted on the tester side.'Expected Telemetry
APM access log entry showing a POST to /my.policy with an abnormally large request body from the tester source IP.
Expected Detection
KQL/SPL correlation flags the source IP for high-volume/anomalous POST activity against APM endpoints.
Injects a synthetic TMM segfault/restart log line into the BIG-IP syslog stream (lab only) to validate crash-correlation logic.
Command
logger -p local0.err -t tmm "notice tmm[12345]: 01010025:5: SIGSEGV received, core dumped, TMM restarting"Cleanup
echo 'Log entry ages out per retention; no manual cleanup needed.'Expected Telemetry
Syslog/TMM log line containing 'SIGSEGV' and 'TMM restarting' ingested by the SIEM.
Expected Detection
SPL/QRadar/Sumo crash-correlation rules increment the crash counter for the host.
Spawns a child shell under a parent named to mimic an APM daemon to validate the EQL/CQL process-lineage detection (lab host only).
Command
bash -c 'exec -a apmd sleep 30 & sleep 1; kill %1' ; setsid bash -c "echo simulated-apmd-child; /bin/sh -c id" &Cleanup
pkill -f 'simulated-apmd-child' 2>/dev/null; echo doneExpected Telemetry
Process-start event showing /bin/sh or bash spawned from a parent process emulating apmd/tmm/httpd.
Expected Detection
Elastic EQL sequence and CrowdStrike CQL join fire on the anomalous BIG-IP-daemon-to-shell process lineage.