CVE-2026-94127: F5 BIG-IP APM OAuth Heap Overflow RCE (KEV)

CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager that is reachable, pre-authentication, on the data plane whenever APM is configured as an OAuth Authorization Server with an OAuth profile on a virtual server, letting an unauthenticated attacker achieve remote code execution — and CISA added it to KEV the same day it was published.

CVE-2026-94127 is a heap-based buffer overflow (CWE-122) in F5 BIG-IP Access Policy Manager (APM). F5's own description, as recorded by NVD, states: "When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server"; F5 further notes "this vulnerability allows an unauthenticated attacker to perform remote code execution," that "the BIG-IP system in Appliance mode is also vulnerable," and that "this is a data plane issue; there is no control plane exposure" (NVD).

NVD lists the CVE as "Analyzed" and records F5's own CVSS v3.1 submission of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with complete impact to confidentiality, integrity and availability (NVD).

CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-22, the same day it was published, with a required-action due date of 2026-09-25, and recommends applying F5's temporary iRule mitigation for forensic triage before installing the final patch (CISA KEV).

F5's knowledge-base article K000162605 lists BIG-IP APM 17.1.0-17.1.3, 17.5.0-17.5.1 and 21.1.0 as the affected branches, each remediated by a specific engineering hotfix, and states that software past End of Technical Support (EoTS) was not evaluated (F5 Security Advisory K000162605).

As of 2026-10-21, FIRST scores the probability of exploitation at 0.0223 (82.6th percentile) (FIRST EPSS).

Because this is an unauthenticated, data-plane remote code execution issue in a widely deployed access-gateway product, any BIG-IP APM virtual server configured as an OAuth Authorization Server on an affected version should apply F5's hotfix (or the temporary iRule mitigation while patching is scheduled) immediately, with forensic triage performed per CISA's BOD 26-04 guidance.

• Heap-based buffer overflow in BIG-IP APM when configured as an OAuth Authorization Server; lets an unauthenticated attacker achieve remote code execution on the data plane (no control-plane exposure). — NVD
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, per F5's own CVSS submission as recorded by NVD (status: Analyzed). — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-22 (same day as publication), due date 2026-09-25; temporary iRule mitigation recommended pending patch. — CISA KEV
• Affects BIG-IP APM 17.1.0-17.1.3, 17.5.0-17.5.1 and 21.1.0, each fixed by a specific engineering hotfix; EoTS versions not evaluated. — F5 Security Advisory K000162605
• EPSS score is 0.0223 (82.6th percentile) as of 2026-10-21. — FIRST EPSS