AL26-022 - Vulnerability impacting F5 BIG-IP Access Policy Manager (APM) – CVE-2026-94127
Canadian Cyber Centre warns CVE-2026-94127, a critical heap buffer overflow in F5 BIG-IP APM enabling unauthenticated RCE, is exploited in the wild.
CVE-2026-94127 is a heap-based buffer overflow (CWE-122) affecting F5 BIG-IP systems where an APM access policy and an OAuth profile are configured on the same virtual server, allowing unauthenticated attackers remote code execution and full system compromise. F5 has indicated the vulnerability is being exploited in the wild. Fixed hotfixes are available for BIG-IP APM versions 17.1.0, 17.5.0, and 21.1.0, and the Cyber Centre recommends applying an F5-provided iRule and reviewing logs for indicators including rapid or high-volume OAuth authentication failures.
- Critical heap buffer overflow CVE-2026-94127 in F5 BIG-IP APM
- Unauthenticated RCE when APM policy and OAuth profile share a virtual server
- F5 confirms active exploitation in the wild
- Hotfixes available for 17.1.0, 17.5.0, and 21.1.0; iRule mitigation recommended
- Detection guidance: review OAuth auth failure spikes and admin account activity
- CVEs
- CVE-2026-94127
- Organizations
- Canadian Centre for Cyber SecurityF5
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
From the original article
2 min read at cyber.gc.ca
Number: AL26-022 Date: September 22, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.