F5's Authentication Appliance Is Under Active Attack and Shares Are Up 75% Anyway

F5 told customers on 22 September that attackers are exploiting a hole in its flagship login appliance↗. CVE-2026-94127, a heap-based buffer overflow in BIG-IP APM running as an OAuth Authorization Server, hands an unauthenticated attacker remote code execution and is scored 9.8 under CVSS v3.1 ¹². CISA listed it as known-exploited the same day↗ and gave federal agencies until Friday, forensic triage required under BOD 26-04 ³.

The flaw sits in the machine that checks every login

APM is the centralized proxy that secures access to enterprise networks, applications, cloud services and APIs↗ ⁴. Versions 21.1.0, 17.5.0 to 17.5.1 and 17.1.0 to 17.1.3 are exposed, appliance mode included, through the data plane; F5 found the bug internally and shipped hotfixes, with a mitigation iRule for slow patchers ¹. Shadowserver counts more than 14,700 internet-facing APM addresses and cannot say how many are patched or honeypots ⁴. The attack tell is repeated OAuth failures, then suspicious commands, then a traffic-management crash↗ ¹. Who pays: the enterprises and agencies behind those addresses, pushed by CISA's deadline into patching and forensic triage ³⁴. Who gets paid: holders of the premium, until a victim is named.

The market's only markdown was the forecast

Fiscal third-quarter revenue hit $865.1 million, up 11 percent, with adjusted EPS of $4.73 against a $3.98 consensus↗ ⁵.

Three days after the advisory, an investor note credited the stock's 75 percent year-to-date gain to AI-security demand and institutional inflows↗, without mentioning the flaw ⁶. The week's one verified down move, a 2.07 percent after-hours drop to $446.55 on 24 September↗, was framed around raised guidance and a sharpened AI-security strategy; that write-up never mentions the CVE either ⁷.

A nation-state already walked out with F5's zero-day notes

A year earlier, F5 disclosed that a nation-state actor held long-term access to its BIG-IP product development environment and left with source code and details of undisclosed vulnerabilities↗ ⁸; the Justice Department allowed F5 to delay that disclosure↗ ⁹. At the time, F5 said it had no knowledge of undisclosed critical or remote-code flaws among the stolen files ⁸, and this week's advisory does not connect the new bug to the theft ¹. F5 has not said how many systems the current campaign has compromised ⁹. Since November 2021, CISA has flagged eight exploited F5 flaws, four of them used in ransomware ⁴.

Growth is real; the tail is unpriced

Exploited zero-days at network vendors are routine now; Check Point and Arista joined the KEV list the same day ³. F5's post-breach containment was validated by NCC Group and IOActive, and CrowdStrike's Falcon EDR ships inside BIG-IP free through 14 October 2026 ⁸. Nothing public this week, least of all the AI-security bull note, priced the fact that the moat and the attack surface ship in the same box ⁶. Watch for victims named out of the KEV triage, and for the fourth quarter against the $870 to 890 million revenue guide ⁵.