Not to be outdone by Citrix, F5’s BIG-IP APM shipped CVE-2026-94127, a 9.8 that CISA put in KEV on 22 September, the same day as the advisory.
watchTowr’s write-up is as short as the bug: with an OAuth authorization-server profile on a virtual server, tmm copies the Authorization header into a 0x4100-byte heap buffer without checking its length, and an oversized header overwrites a neighbouring function pointer roughly nine times out of ten.
SELinux blocked the obvious execvp, so they appended their command to /etc/bigstart/scripts/tmm.finish, a script that runs whenever tmm crashes, and then crashed it again.
When the crash handler becomes the persistence mechanism, the crash is no longer the bad news.
