CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM
F5 patches critical CVSS 9.8 heap-based buffer overflow (CVE-2026-94127) in BIG-IP APM that allows unauthenticated RCE, now added to CISA KEV list.
F5 has patched a critical heap-based buffer overflow vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager (APM) that could allow unauthenticated remote code execution. The flaw, with a CVSS v3.1 score of 9.8, is exploitable by sending specially crafted traffic to a vulnerable virtual server configured with both an APM access policy and an OAuth profile. The vulnerability affects the data plane and has been added to the CISA KEV list. F5 has provided hotfixes for affected release trains.
- F5 BIG-IP APM has a critical heap-based buffer overflow vulnerability (CVE-2026-94127) with a CVSS score of 9.8.
- An unauthenticated attacker with network access can achieve remote code execution by sending crafted traffic.
- The vulnerability requires a specific configuration: an APM access policy and an OAuth profile on a virtual server.
- The CVE has been added to the CISA Known Exploited Vulnerabilities (KEV) list.
- CVEs
- CVE-2026-94127
- Vendors
- F5
- Products
- BIG-IP APM
- Organizations
- F5
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
From the original article
2 min read at rapid7.com
Overview On September 22, 2026, F5 published a security advisory for CVE-2026-94127, a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM). The vulnerability has a CVSS v3. 1 score of 9.
By Rapid7 · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.