F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.
  • Highest CVSS: 9.8 (Critical).
  • Listed in CISA KEV (2026-09-22) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-94127.

What it is

CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM). It is triggered on a virtual server that has both an access policy and an OAuth profile configured. Specific traffic sent to that virtual server can corrupt heap memory and lead to remote code execution.

The access path is unauthenticated and over the network — no credentials or prior session are needed. F5 describes this as a data plane issue, with no control plane exposure, meaning the flaw is reached through the traffic the virtual server is processing, not through the management interface. Appliance mode does not provide protection here; F5 states systems running in Appliance mode are also vulnerable.

The impact is remote code execution, and the CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) confirms no privileges or user interaction are required and full compromise of confidentiality, integrity and availability is possible. CVE-2026-94127 carries a CVSS score of 9.8 (Critical) and is listed in CISA’s Known Exploited Vulnerabilities catalogue, added 22 September 2026.

What to do

  • Identify any virtual servers that combine an APM access policy with an OAuth profile — this is the specific configuration that exposes the flaw. Systems without this combination are not affected by this issue.
  • Consult F5’s advisory for CVE-2026-94127 for the fixed release train applicable to your BIG-IP version; no fixed version numbers have been published in the sources reviewed for this brief, so check directly with F5 before assuming a patch is available.
  • Given the KEV listing, treat this as a priority for patching or mitigation once F5 publishes a fix, rather than something to schedule for a routine maintenance window.
  • If patching cannot happen immediately, consider whether the affected virtual servers can be taken offline, have OAuth temporarily disabled, or be restricted at the network layer while remediation is arranged.
  • Note that Appliance mode does not mitigate this vulnerability, so do not rely on it as a compensating control.

For leadership 🧭

Executive summary. Any BIG-IP virtual server pairing an APM access policy with an OAuth profile can be remotely hijacked without credentials, and this flaw is already listed as actively exploited. Given the CVSS 9.8 rating and KEV listing, this needs identification and mitigation today, with patching as soon as F5 publishes a fix.

Why it matters:

  • The vulnerability sits on the data plane, meaning it’s reached through normal traffic to the virtual server rather than the management interface, so network segmentation of the management plane offers no protection.
  • Appliance mode, often relied on as a hardened deployment option, does not mitigate this issue according to F5, removing a control some teams may be counting on.
  • No authentication, prior session or user interaction is required, and the CVSS vector confirms full compromise of confidentiality, integrity and availability is possible on affected virtual servers.
  • The specific configuration at risk – an access policy combined with an OAuth profile on the same virtual server – is a common pattern for federated or SSO access, meaning production login paths could be exposed.

Now / Next / Later:

  • Now: Search your BIG-IP estate for any virtual server that has both an APM access policy and an OAuth profile configured – that combination is the exposure, and systems without it are not affected.
  • Next: Check F5’s advisory for CVE-2026-94127 directly for a fixed release matching your BIG-IP version and apply it in the next available change window, prioritising this ahead of routine patching given its KEV status.
  • Later: For any affected virtual server that cannot be patched immediately, disable the OAuth profile or restrict network access to it, and build a standing inventory of APM configurations combining access policies with OAuth so future advisories affecting this pattern can be triaged quickly.

Source