CVE-2026-94127

Analyzed Analyzed - Analysis Complete

Remote Code Execution in F5 BIG-IP APM

Publication date: 2026-09-22

Last updated on: 2026-09-23

Assigner: F5 Networks

Description

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-23

Generated

2026-10-13

AI Q&A

2026-09-22

EPSS Evaluated

2026-10-11

NVD

CVE-2026-94127

EUVD

EUVD-2026-84427

Affected Vendors & Products

Vendor	Product	Version / Range
f5	big-ip_access_policy_manager	From 17.5.0 (inc) to 17.5.1 (inc)
f5	big-ip_access_policy_manager	From 17.0.0 (inc) to 17.1.3 (inc)
f5	big-ip_access_policy_manager	21.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability exists in F5 BIG-IP APM when an access policy and OAuth profile are configured on a virtual server. Malicious traffic can exploit this to execute arbitrary code remotely on the system.

Detection Guidance

This vulnerability requires specific BIG-IP APM and OAuth profile configurations. Detection involves checking for vulnerable configurations rather than running commands to exploit it. Review BIG-IP APM access policies and OAuth profiles on virtual servers for misconfigurations. Check logs for unusual traffic patterns targeting APM or OAuth endpoints.

Impact Analysis

An unauthenticated attacker could gain full control over the affected BIG-IP system, potentially leading to data breaches, service disruption, or further network compromise. Appliance mode systems are also at risk.

Compliance Impact

This RCE vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information security) requirements. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Apply the latest security patches from F5 for BIG-IP APM and OAuth profile configurations. Disable or restrict access to vulnerable virtual servers until patched. Monitor network traffic for unusual patterns targeting APM or OAuth endpoints.

Hi! I’m here to help you understand CVE-2026-94127. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70