CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

Executive Summary

F5 has disclosed CVE-2026-94127, a critical heap-based buffer overflow (CWE-122) affecting BIG-IP Access Policy Manager (APM). The vulnerability is present when a BIG-IP virtual server has both an access policy and an OAuth profile configured. Under that configuration, specially crafted traffic reaching the virtual server can corrupt heap memory in the data-plane component that handles OAuth authentication flows, and F5 states the flaw could allow an unauthenticated attacker to achieve remote code execution (RCE).

CVSS Score: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (network attack vector, low complexity, no privileges or user interaction required, full impact to confidentiality, integrity, and availability). A CVSS v4.0 score of approximately 9.3 has also been reported.

On 2026-09-22, CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog as part of a batch of four newly listed flaws, citing evidence of active exploitation in the wild. The KEV entry carries a due date of 2026-09-25 — an unusually tight three-day federal remediation window that reflects the confirmed in-the-wild exploitation and unauthenticated network-reachable attack surface. This is a data-plane issue handled by the Traffic Management Microkernel (TMM); F5 states there is no control-plane exposure, and systems running in Appliance mode are also affected.

Vulnerability Overview

Affected Versions

Public reporting on F5's advisory (K000162605) describes the following affected BIG-IP APM branches, each fixed by a vendor engineering hotfix:

Treat these ranges as general guidance rather than exact build numbers. Any BIG-IP APM instance with an access policy and an OAuth profile bound to the same virtual server should be considered at risk until confirmed patched — administrators should verify their exact version and hotfix level directly against F5's advisory K000162605 on my.f5.com rather than relying solely on secondary reporting.

Attack Vector

1. An administrator has configured a BIG-IP virtual server with both an APM access policy and an OAuth profile — a common pattern for SSO/OAuth-based application access proxying.
2. An unauthenticated attacker sends specially crafted requests toward that virtual server, targeting the OAuth authentication flow that APM's data-plane component parses.
3. Malformed or oversized fields in the crafted OAuth traffic cause the APM/TMM code path to write past the bounds of a heap-allocated buffer during processing.
4. The resulting heap corruption can be leveraged to redirect execution flow, allowing the attacker to achieve remote code execution in the context of the data-plane process — without ever needing valid credentials or a legitimate OAuth token.
5. Because the flaw lives in the data plane, appliances configured in Appliance mode (which restricts shell/control-plane access) remain exploitable via this network path.

F5 and CISA have both indicated evidence of real-world exploitation of this flaw; as of this writing no public proof-of-concept or Metasploit/Nuclei module has been confirmed, but the KEV listing alone should be treated as active-exploitation confirmation.

Impact of Successful Exploitation

Immediate Remediation

1. Patch first. Apply the F5 engineering hotfix for your BIG-IP APM branch identified in advisory K000162605 as soon as possible. Federal agencies are on a CISA KEV due date of 2026-09-25; treat that as the outer bound, not the target.
2. Workaround if you cannot patch immediately: F5 has made an emergency iRule mitigation available through F5 Support that can be attached to affected virtual servers to block the malicious traffic pattern while a patch window is scheduled. Contact F5 Support to obtain the current iRule.
3. Reduce exposure: where feasible, temporarily disable or unbind the OAuth profile from virtual servers that also carry an access policy until the hotfix is applied — this removes the vulnerable configuration combination entirely, at the cost of breaking OAuth-based access for that virtual server.
4. Restrict network reach: ensure management and application virtual servers exposed to this configuration are not reachable from untrusted networks any more broadly than required; this does not fully mitigate the flaw but reduces the attack surface while patching is scheduled.
5. Verify build/hotfix level directly against F5's advisory rather than relying on version numbers alone — hotfix engineering builds do not always map cleanly to version strings shown in the UI.

Detection Indicators

CISA KEV Context

Inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog means CISA has direct evidence that a vulnerability is being actively exploited in the wild — it is not a theoretical or research-only finding. Under Binding Operational Directive BOD 22-01, Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities on internet-facing and internal assets by the catalog's specified due date, which for most entries falls within roughly two to three weeks of the date added. CVE-2026-94127 was added on 2026-09-22 with a due date of 2026-09-25 — a compressed timeline that signals CISA's assessment of both the severity (unauthenticated RCE) and the confirmed exploitation activity. Private-sector organizations are not legally bound by BOD 22-01, but security teams broadly treat the KEV catalog and its due dates as an authoritative signal of real-world risk and should prioritize remediation on the same timeline as federal agencies, if not faster given internet-facing BIG-IP deployments are common targets.

Post-Remediation Steps

1. Confirm the hotfix is active by verifying the running software/hotfix version against F5's advisory rather than assuming a package install succeeded.
2. Review APM and TMM logs across the exploitation window (back to when the OAuth profile was first paired with an access policy on each affected virtual server) for signs of the indicators listed above.
3. Rotate any credentials, session secrets, or OAuth client secrets handled by affected virtual servers if any compromise indicators are found.
4. Re-enable any OAuth profiles that were temporarily disabled as a workaround, now that the underlying hotfix is applied.
5. Remove any emergency iRule mitigation once the hotfix is confirmed active, unless F5 guidance indicates it should remain as defense-in-depth.
6. Add BIG-IP APM version/hotfix tracking to routine patch-management review given this is the second APM OAuth/access-policy RCE disclosed in this vulnerability class within the year.

References

• NVD — CVE-2026-94127
• F5 Security Advisory K000162605
• CISA — Known Exploited Vulnerabilities Catalog