Critical F5 BIG-IP APM Flaw Actively Exploited for Remote Code Execution
F5 says CVE-2026-94127, a critical unauthenticated BIG-IP APM RCE, is already exploited in the wild.
F5 disclosed CVE-2026-94127, a heap-based buffer overflow in BIG-IP Access Policy Manager scored CVSS 9.8 (v3.1) and 9.3 (v4.0), and said it is already exploited. Unauthenticated attackers can execute code when an APM virtual server is configured as an OAuth Authorization Server. Affected releases include 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3, with engineering hotfixes available. Indicators include repeated OAuth failures, suspicious command activity, and TMM crashes producing SIGABRT.
- CVE-2026-94127 is unauthenticated RCE, CVSS 9.8, actively exploited.
- Only APM virtual servers acting as OAuth Authorization Servers are affected.
- Hotfixes cover BIG-IP 21.1.0, 17.5.x, and 17.1.x branches.
- BIG-IP Next, BIG-IQ, NGINX, and F5OS are not vulnerable.
- F5 offers a support-only iRule if immediate patching is impossible.
- CVEs
- CVE-2026-94127
- Vendors
- F5
- Products
- BIG-IPBIG-IP APM
- Organizations
- F5
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
From the original article
2 min read at gbhackers.com
F5 has disclosed a critical remote code execution vulnerability in its BIG-IP Access Policy Manager (APM) that is already being exploited in the wild. This vulnerability, tracked as CVE-2026-94127, allows unauthenticated attackers to execute code on affected BIG-IP systems when a vulnerable OAuth configuration is exposed through an APM virtual server. Published on September 22, […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.