CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM

What it is

CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM), CVSS 9.8, publicly disclosed by F5 on September 22, 2026.

How it works

An unauthenticated attacker with network access to an affected virtual server can trigger remote code execution by sending specifically crafted traffic that overflows a heap buffer. The flaw sits in the data plane only — the BIG-IP control plane is not exposed.

Preconditions / Affected

Exploitation requires a BIG-IP virtual server with both an APM access policy and an OAuth profile configured together; it is not exposed in a default configuration. BIG-IP APM integrates with OAuth, OpenID Connect, and SAML, but only the OAuth-profile pairing is named as the trigger condition. Systems running in Appliance mode are also affected. As of September 22, 2026, no public proof-of-concept was confirmed, but the CVE is already in CISA's KEV catalog.

What to do

1. Check whether any virtual server has an APM access policy and an OAuth profile configured together — this is the prerequisite for exposure.
2. Apply the fixed hotfix for your release train: - BIG-IP 21.1.0 → Hotfix-BIGIP-21.1.0.2.0.30.22-ENG or later - BIG-IP 17.5.0 → Hotfix-BIGIP-17.5.1.9.0.160.12-ENG or later - BIG-IP 17.1.0 → Hotfix-BIGIP-17.1.3.5.0.41.14-ENG or later
3. If immediate patching isn't feasible, open a support case with F5 to obtain the vendor-provided iRule workaround.
4. Rapid7 Exposure Command, Vulnerability Management, and Nexpose customers can check exposure via vulnerability checks expected in the September 23 content release.

Caveats

F5's advisory does not describe the overflow mechanism beyond "heap-based buffer overflow triggered by crafted traffic" — no further technical detail is given. No public exploit code was confirmed at time of publication, so KEV listing reflects known/suspected exploitation rather than a disclosed PoC.