Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)
watchTowr details actively exploited unauthenticated heap overflow CVE-2026-94127 in F5 BIG-IP APM, enabling RCE via oversized Authorization headers.
F5 advisory K000162605 (published Sept 22) discloses CVE-2026-94127, an unauthenticated heap overflow in BIG-IP APM where an oversized Authorization header overflows a 0x4100-byte heap buffer, allowing pre-auth RCE on appliances at the network edge. F5 states the vulnerability is being actively exploited. watchTowr patch-diffed BIG-IP 21.1.0 against the fixed hotfix build using IDA and Diaphora across 1,728 functions, finding the fix adds a size check rejecting Authorization headers over 0x4100 bytes. Fixes are hotfix ISOs for the 21.1.0, 17.5.1, and 17.1.3 branches; other BIG-IP modules and BIG-IQ are listed as not affected.
- Unauthenticated heap overflow in BIG-IP APM OAuth Authorization header handling gives RCE
- F5 advisory K000162605 confirms active exploitation in the wild
- Fix adds 0x4100-byte size check; hotfixes ship for 21.1.0, 17.5.1, 17.1.3
- Only APM branch affected; other BIG-IP modules and BIG-IQ not vulnerable
- CVEs
- CVE-2026-94127
- Organizations
- F5watchTowr LabsBIG-IP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 21.1.0.2 | Vulnerable: BIG-IP 21.1.0 , build 0.0.38 Different: BIG-IP 21.1.0.2 , hotfix build 0.30.22 Patch-Diffing Our Way Out Of Hell As |
| md5 | aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa | uth2/v1/userinfo HTTP/1.1 Host: bigip Authorization: Bearer AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... Connection: close We immediately got a crash. Oh, were y |
From the original article
9 min read at labs.watchtowr.com
Well, well, well, well, well, well, well, well, well, well, well, well, well, well, well. We're back. Sorry.
By Sina Kheirkhah (@SinSinology) · labs.watchtowr.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.