2026-013: Critical Vulnerability in F5 BIG-IP APM
CERT-EU says exploited F5 BIG-IP APM flaw CVE-2026-94127 allows unauthenticated remote code execution.
On 22 September 2026, CERT-EU warned that F5 BIG-IP APM vulnerability CVE-2026-94127, a CVSS 9.8 heap-based buffer overflow, allows unauthenticated remote code execution when an access policy and OAuth profile are configured on a virtual server. F5 confirmed active exploitation. Affected versions include 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0. CERT-EU urges immediate hotfixes, evidence preservation, and checks for OAuth failures followed by suspicious commands and TMM crashes.
- CVE-2026-94127 is a CVSS 9.8 heap overflow enabling unauthenticated RCE.
- It applies when an access policy and OAuth profile are configured.
- F5 confirmed active exploitation in the wild.
- Affected branches include 17.1, 17.5, and 21.1.
- CERT-EU urges hotfixes, forensics, and compromise checks.
- CVEs
- CVE-2026-94127
- Vendors
- F5
- Products
- BIG-IP APMBIG-IP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
From the original article
2 min read at cert.europa.eu
On 22 September 2026, F5 published an advisory addressing a critical vulnerability affecting its BIG-IP APM product. The vendor confirmed active exploitation in the wild. CERT-EU recommends taking appropriate actions as soon as possible.
cert.europa.eu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.