CVE-2026-94127, a critical vulnerability affecting certain F5 BIG-IP Access Policy Manager deployments, is being exploited in the wild and can allow an unauthenticated remote attacker to execute code on vulnerable systems.
The flaw affects BIG-IP APM virtual servers configured with both an APM access policy and an OAuth profile. The vulnerable configuration is specifically associated with BIG-IP APM operating as an OAuth Authorization Server.
F5 assigned the issue CVE-2026-94127 and published security advisory K000162605 on September 22, 2026. The vulnerability has also been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog following confirmed exploitation activity.
CVE-2026-94127 Allows Unauthenticated Remote Code Execution
CVE-2026-94127 is a heap-based buffer overflow, categorized as CWE-122.
Specially crafted network traffic reaching an affected BIG-IP APM virtual server can trigger memory corruption and potentially allow arbitrary code execution.
The vulnerability does not require authentication, privileges or user interaction.
F5’s CVE record assigns the issue a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3, placing it in the Critical severity range.
For broader coverage of actively exploited vulnerabilities, see CyberUpdates365’s Critical CVE Vulnerabilities 2026 security hub.
Only Specific BIG-IP APM OAuth Configurations Are Exposed
The presence of BIG-IP APM alone does not automatically make a system vulnerable.
The affected virtual server must have both:
- an APM access policy configured
- an OAuth profile configured
The vulnerable condition applies when APM is functioning as an OAuth Authorization Server.
F5 documentation describes the OAuth authorization-server role as providing endpoints for authorization, token issuance, token revocation and token introspection.
Deployments using APM only as an OAuth client or resource server, without the vulnerable authorization-server configuration, are not covered by the affected configuration described in the advisory.
Affected F5 BIG-IP Versions
According to the vendor-issued CVE information and government security advisories, the following supported BIG-IP APM branches are affected when the vulnerable OAuth configuration is present:
| BIG-IP APM Branch | Remediation Level |
|---|---|
| 21.1.0 | Hotfix-BIGIP-21.1.0.2.0.30.22-ENG or later applicable fix |
| 17.5.0–17.5.1 | Hotfix-BIGIP-17.5.1.9.0.160.12-ENG or later applicable fix |
| 17.1.0–17.1.3 | Hotfix-BIGIP-17.1.3.5.0.41.14-ENG or later applicable fix |
Administrators should verify the exact supported build and remediation guidance against F5 advisory K000162605 before making production changes.
F5 also notes that software versions which have reached End of Technical Support were not evaluated. Their absence from the affected-version list should therefore not be interpreted as confirmation that they are safe.
The Vulnerability Is in the Data Plane
An important technical detail is that CVE-2026-94127 affects the data plane, not the BIG-IP management or control plane.
This means simply restricting access to the administrative interface does not remove exposure if an affected virtual server continues to receive attacker-controlled traffic.
BIG-IP systems operating in Appliance mode can also be vulnerable when the affected configuration is present.
CISA Lists CVE-2026-94127 as Known Exploited
CVE-2026-94127 was added to CISA’s Known Exploited Vulnerabilities catalog on September 22, 2026.
The KEV designation means there is evidence that attackers have successfully exploited the vulnerability in real-world environments.
CISA set a September 25, 2026 remediation deadline for applicable U.S. federal systems under its current risk-based vulnerability remediation requirements.
At the time of publication, publicly available information does not identify the attackers responsible, the number of compromised organizations or their post-compromise objectives.
How to Check for Signs of Exploitation
F5 guidance, also reproduced by CERT-EU, recommends looking for a combination of events rather than treating any single log entry as proof of compromise.
Security teams should investigate situations where repeated OAuth authentication failures are followed by suspicious command activity and then a Traffic Management Microkernel, or TMM, SIGABRT event.
Review OAuth Authentication Failures
Administrators should review /var/log/apm for repeated OAuth failures, particularly a burst of invalid-token errors originating from the same source IP address.
Ten or more similar failures within a short period may warrant closer investigation.
Check OAuth Failure Statistics
F5 administrators can review OAuth statistics using the vendor-documented command:
- Run command:
tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed
An unexplained increase in total_failed should be correlated with other system and network evidence rather than treated as a standalone compromise indicator.
Review Audit Logs
If suspicious OAuth failures are identified, defenders should inspect /var/log/audit around the same timestamps for unexpected or unauthorized commands.
Investigate TMM Core Files
A TMM core file can also appear during exploitation-related conditions.
However, the presence of a core file alone does not prove that the vulnerability was exploited. F5 notes that defenders should examine the timing and relationship between OAuth failures, suspicious commands and the TMM event.
Patch CVE-2026-94127 as a Priority
Organizations running affected BIG-IP APM configurations should first identify virtual servers that combine an APM access policy with an OAuth profile.
Administrators should then apply the relevant F5 hotfix or subsequent vendor-supported remediation for their software branch.
Because exploitation has already been confirmed, patching should be accompanied by retrospective threat hunting rather than assuming installation of the fix alone resolves the incident risk.
Organizations should preserve relevant logs and forensic evidence before making major changes when compromise is suspected.
Temporary Mitigation Is Available Through F5 Support
For organizations that cannot immediately install the appropriate hotfix, F5 provides an iRule-based temporary mitigation for affected virtual servers.
The iRule is intended as an interim measure and customers should obtain the current version directly from F5 Support rather than copying unofficial mitigation code from third-party sources.
The vendor-supported patch remains the preferred long-term remediation.
Why Internet-Facing BIG-IP Devices Are High-Value Targets
BIG-IP systems frequently sit at critical boundaries between external users and internal applications.
Depending on deployment architecture, these appliances can perform traffic management, authentication, application access and security functions for high-value enterprise services.
An unauthenticated RCE vulnerability in an exposed network appliance can therefore create a particularly serious security risk because an attacker may gain code execution before reaching the protected application itself.
This pattern has also been seen across other network and edge infrastructure vulnerabilities. CyberUpdates365 previously covered an actively exploited Cisco ASA zero-day RCE vulnerability, highlighting why externally reachable security appliances require aggressive patch management.
What Security Teams Should Do Now
- inventory BIG-IP APM systems and exposed virtual servers
- identify virtual servers using both an APM access policy and OAuth profile
- verify whether APM is functioning as an OAuth Authorization Server
- apply the appropriate F5 hotfix as soon as operationally possible
- use the vendor-provided iRule mitigation if immediate patching is impossible
- preserve APM, audit and system logs before remediation when compromise is suspected
- review repeated OAuth invalid-token events
- correlate authentication failures with suspicious commands
- investigate unexpected TMM crashes or core files
- do not assume management-interface restrictions remove data-plane exposure
CyberUpdates365 Analysis
The most important detail about CVE-2026-94127 is its narrow configuration requirement combined with severe impact.
Not every BIG-IP APM deployment is exposed, but organizations that do use the vulnerable OAuth Authorization Server configuration face an unauthenticated network-accessible RCE issue that is already associated with real-world exploitation.
This makes accurate asset inventory particularly important.
Security teams should avoid two opposite mistakes: treating every BIG-IP appliance as compromised, or assuming that restricting the management interface removes the vulnerability.
The correct response is to identify the affected configuration, patch it, preserve forensic evidence and investigate the specific indicators described by F5.
What Remains Unknown
- The identity of the attackers exploiting CVE-2026-94127 has not been publicly established.
- The number of successfully compromised organizations has not been disclosed.
- Public reporting has not established the attackers’ post-compromise objectives.
- Versions that have reached End of Technical Support were not evaluated by F5.
Official Sources
- F5 Security Advisory K000162605 — BIG-IP APM vulnerability CVE-2026-94127
- CISA Known Exploited Vulnerabilities Catalog — CVE-2026-94127
- CERT-EU Security Advisory 2026-013 — Critical Vulnerability in F5 BIG-IP APM
- Canadian Centre for Cyber Security — F5 Security Advisory AV26-949
Bottom Line
CVE-2026-94127 is a critical F5 BIG-IP APM heap-based buffer overflow that can allow unauthenticated remote code execution when a virtual server uses both an APM access policy and an OAuth profile.
Because exploitation in the wild has been confirmed, organizations with affected configurations should prioritize patching, preserve forensic evidence and review systems for the exploitation indicators documented by F5.
