alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT F5 BIG-IP APM Unauthenticated Auth Header Heap Overflow (CVE-2026-94127)"; flow:established,to_server; http.uri; content:"/f5-oauth/v1/"; fast_pattern; startswith; http.header; content:"authorization|3a 20|bearer"; nocase; pcre:"/^[^\x0d\x0a]{16633,}/R"; reference:url,labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/; reference:cve,2026-94127; classtype:attempted-admin; sid:2072317; rev:1; metadata:affected_product F5, attack_target Server, tls_state TLSDecrypt, created_at 2026_10_01, cve CVE_2026_94127, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, updated_at 2026_10_01, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)