Critical severity · published Sep 22, 2026
CVE-2026-94127
BIG-IP APM OAuth vulnerability
In wildKEV
9.8
CVSS
24.9%
EPSS
Yes
On KEV
Description
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.
Impact:
This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)24.9% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed Sep 22, 2026
Federal remediation dueSep 25, 2026
Ransomware campaign useNot known
Affected products
Which versions
BI
BIG-IP · F5
21.1.0 before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG; 17.5.0 before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG; 17.1.0 before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG · source: vendor
BA
Big-ip Access Policy Manager · F5
17.0.0 through 17.1.3; 17.5.0 through 17.5.1; 21.1.0 · source: NVD
BA
BIG-IP APM · F5
All versions, or not specified · source: KEV
In the news
ThreatIntelCritical
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers
Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says.
The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes.
Sep 23, 2026·The Hacker News
VulnerabilityHigh
[CISA KEV] CVE-2026-94127: F5 BIG-IP APM - F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.
BABIG-IP APMCVE-2026-94127
Sep 22, 2026·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-94127
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-94127
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://my.f5.com/manage/s/article/K000162605
More from BIG-IP
9.8
CVE-2025-53521
BigIP APM Vulnerability
9.8
CVE-2023-46747
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
9.8
CVE-2022-1388
F5 BIG-IP Missing Authentication Vulnerability
9.8
CVE-2021-22991
F5 BIG-IP Traffic Management Microkernel Buffer Overflow
9.8
CVE-2020-5902
F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability