CVE-2026-94127

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 24.94%
EPSS Percentile: 97.90%
CISA KEV: YES — Known Exploited Vulnerability

Description

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 22-Sep-2026 22:17
Last Modified: 23-Sep-2026 21:32
EPSS Date: 2026-10-25
CWE: CWE-122

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CISA KEV Details

Date Added: 2026-09-22
Remediation Due: 2026-09-25
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: For temporary mitigation to allow for proactive forensic triage, apply the vendor-provided iRule. Once completed, install the final vendor patch as soon as possible. For more information please see: https://my.f5.com/manage/s/article/K000162605 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-94127

CNA Products / Version Status

F5 · BIG-IP Source: CNA · [email protected]
Default status: unknown

21.1.0 ≤ version < Hotfix-BIGIP-21.1.0.2.0.30.22-ENG — affected (custom)
17.5.0 ≤ version < Hotfix-BIGIP-17.5.1.9.0.160.12-ENG — affected (custom)
17.1.0 ≤ version < Hotfix-BIGIP-17.1.3.5.0.41.14-ENG — affected (custom)

Modules: APM

Affected Products / Versions

f5 / big-ip_access_policy_manager Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 17.0.0 · through (inclusive) 17.1.3
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
f5 / big-ip_access_policy_manager Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 17.5.0 · through (inclusive) 17.5.1
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
f5 / big-ip_access_policy_manager Source: NVD CPE · affected
Version / affected range: 21.1.0
cpe:2.3:a:f5:big-ip_access_policy_manager:21.1.0:*:*:*:*:*:*:*

References

Last enrichment sync: 04-Nov-2026 10:04
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (9)

F5 BIG-IP APM: CVE-2026-94127 is a critical heap overflow that can allow unauthenticated remote code execution on systems configured as OAuth authorization servers. InfraTrust Report Warns of Exploited Flaws in Critical Network Infrastructure
3. F5 BIG-IP APM RCE (CVE-2026-94127) 10 RCE Vulnerabilities Defenders Should Prioritize, Including Exploited Zero-Days
CVE-2026-94127 Recorded Future Reports 94 High-Impact Vulnerabilities in September 2026, Including 80 Actively Exploited
CVE-2026-94127 is an unauthenticated heap buffer overflow in F5 BIG-IP APM enabling remote code execution. CVE-2026-94127 Exploits F5 BIG-IP APM Heap Overflow for Unauthenticated RCE
F5 confirmed active exploitation of CVE-2026-94127, a CVSS 9.8 flaw allowing code execution without login. Cybersecurity roundup: Gemini reaches real companies in a test, flaws exploited

CVE (88)

Malware (6)

People (7)

Threat Actors (8)

MITRE ATT&CK (2)

Vendors (42)

Products (96)

Tools (9)

Industries (2)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.