CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager that is reachable, pre-authentication, on the data plane whenever APM is configured as an OAuth Authorization Server with an OAuth profile on a virtual server, letting an unauthenticated attacker achieve remote code execution — and CISA added it to KEV the same day it was published.
Vulnerability summary
CVSS base score
9.8
Critical severity
EPSS score (FIRST)
2.2%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2026-94127 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| F5 BIG-IP Access Policy Manager (APM) | cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* | 17.1.0 through 17.1.3 (fixed via Hotfix-BIGIP-17.1.3.5.0.41.14-ENG); 17.5.0 through 17.5.1 (fixed via Hotfix-BIGIP-17.5.1.9.0.160.12-ENG); 21.1.0 (fixed via Hotfix-BIGIP-21.1.0.2.0.30.22-ENG). Only present when APM is configured as an OAuth Authorization Server; versions past End of Technical Support were not evaluated. |
What does this mean for affected devices?
CVE-2026-94127 is a heap-based buffer overflow (CWE-122) in F5 BIG-IP Access Policy Manager (APM). F5's own description, as recorded by NVD, states: "When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server"; F5 further notes "this vulnerability allows an unauthenticated attacker to perform remote code execution," that "the BIG-IP system in Appliance mode is also vulnerable," and that "this is a data plane issue; there is no control plane exposure" (NVD).
NVD lists the CVE as "Analyzed" and records F5's own CVSS v3.1 submission of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with complete impact to confidentiality, integrity and availability (NVD).
CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-22, the same day it was published, with a required-action due date of 2026-09-25, and recommends applying F5's temporary iRule mitigation for forensic triage before installing the final patch (CISA KEV).
F5's knowledge-base article K000162605 lists BIG-IP APM 17.1.0-17.1.3, 17.5.0-17.5.1 and 21.1.0 as the affected branches, each remediated by a specific engineering hotfix, and states that software past End of Technical Support (EoTS) was not evaluated (F5 Security Advisory K000162605).
As of 2026-10-21, FIRST scores the probability of exploitation at 0.0223 (82.6th percentile) (FIRST EPSS).
Because this is an unauthenticated, data-plane remote code execution issue in a widely deployed access-gateway product, any BIG-IP APM virtual server configured as an OAuth Authorization Server on an affected version should apply F5's hotfix (or the temporary iRule mitigation while patching is scheduled) immediately, with forensic triage performed per CISA's BOD 26-04 guidance.
Evidence
- Heap-based buffer overflow in BIG-IP APM when configured as an OAuth Authorization Server; lets an unauthenticated attacker achieve remote code execution on the data plane (no control-plane exposure). — NVD
- CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, per F5's own CVSS submission as recorded by NVD (status: Analyzed). — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-22 (same day as publication), due date 2026-09-25; temporary iRule mitigation recommended pending patch. — CISA KEV
- Affects BIG-IP APM 17.1.0-17.1.3, 17.5.0-17.5.1 and 21.1.0, each fixed by a specific engineering hotfix; EoTS versions not evaluated. — F5 Security Advisory K000162605
- EPSS score is 0.0223 (82.6th percentile) as of 2026-10-21. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
What specific APM configuration exposes a BIG-IP system to CVE-2026-94127?
The flaw is only present when BIG-IP APM is configured as an OAuth Authorization Server, with an access policy and an OAuth profile configured on a virtual server; F5's own description notes the BIG-IP system in Appliance mode is also vulnerable (per NVD).
Does this vulnerability expose the BIG-IP control plane as well as the data plane?
No — F5 states explicitly that "this is a data plane issue; there is no control plane exposure" (per NVD).
Does an attacker need any credentials to trigger the heap overflow?
No — F5 states "this vulnerability allows an unauthenticated attacker to perform remote code execution" (per NVD).
Which BIG-IP APM branches are affected and how are they fixed?
17.1.0 through 17.1.3 (fixed via Hotfix-BIGIP-17.1.3.5.0.41.14-ENG), 17.5.0 through 17.5.1 (fixed via Hotfix-BIGIP-17.5.1.9.0.160.12-ENG), and 21.1.0 (fixed via Hotfix-BIGIP-21.1.0.2.0.30.22-ENG); versions past End of Technical Support were not evaluated (per F5 Security Advisory K000162605).
Is there a temporary mitigation while a hotfix is scheduled?
CISA's KEV entry recommends applying F5's temporary iRule mitigation for forensic triage before installing the final patch (per CISA KEV).
Questions about this page?