cyber.hendryadrian.com
Vulnerability & Exploit · rapid7.com

Critical F5 BIG-IP APM Flaw Enables Unauthenticated Remote Code Execution

· Original article ↗

Summary

CVE-2026-94127 is a critical heap-based buffer overflow in F5 BIG-IP APM that may allow unauthenticated RCE when an APM access policy and OAuth profile are configured together. F5 released hotfixes, and the flaw is listed in CISA KEV.

Key points

  • The heap-based buffer overflow has a CVSS 3.1 score of 9.8 and may allow remote code execution by sending crafted traffic to an affected virtual server.
  • Exposure requires both an APM access policy and an OAuth profile configured on the same virtual server; the flaw is not exposed in a default configuration.
  • The vulnerability affects the data plane, not the control plane. BIG-IP systems in Appliance mode are also affected.
  • Affected release trains are BIG-IP 21.1.0, 17.5.0, and 17.1.0; F5 lists fixed hotfixes for each.
  • CVE-2026-94127 was added to CISA's Known Exploited Vulnerabilities catalog on September 22, 2026; a public proof of concept was not confirmed.
  • F5 recommends applying the applicable hotfix. Customers unable to update immediately can request an iRule workaround through F5 Support.

Article Details

Vulnerability Types
  • Heap-based buffer overflow
  • Unauthenticated remote code execution
Severity
Critical; CVSS v3.1 score 9.8
Affected Versions
  • BIG-IP 21.1.0 versions prior to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
  • BIG-IP 17.5.0 versions prior to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
  • BIG-IP 17.1.0 versions prior to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Obtain the iRule workaround from F5 Support and follow F5's implementation guidance.

CVE

CVE-2026-94127On September 22, 2026, F5 published a security advisory for CVE-2026-94127, a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM). The vulnerability has a CVSS v3.1 score of

Vendors

F5On September 22, 2026, F5 published a security advisory for CVE-2026-94127, a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM). The vulnerability has a CVSS v3.1 score of

Products

BIG-IPa security advisory for CVE-2026-94127, a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM). The vulnerability has a CVSS v3.1 score of 9.8. An unauthenticated attackerBIG-IP Access Policy Manager (APM)for CVE-2026-94127, a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM). The vulnerability has a CVSS v3.1 score of 9.8. An unauthenticated attacker with networkExposure CommandExposure Command, Vulnerability Management, and NexposeNexposeExposure Command, Vulnerability Management, and NexposeVulnerability ManagementExposure Command, Vulnerability Management, and Nexpose

Related Articles