CVE-2026-94127KEV · OVERDUECWE-122

F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

Critical · published September 22, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 82.6th percentile for exploit probability.

30
days past CISA
deadline
CVSS v3.1
9.8
EPSS
2%
Percentile
82.6
In the wild
Confirmed
What it is

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.

Impact:

This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02226 · 82.6th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2026-09-22T19:17Z
KEV added
2026-09-22 · due 2026-09-25
Affected products (3)
ProductVersionsFixed in
f5/big-ip_access_policy_manager≥ 17.0.0, ≤ 17.1.3—
f5/big-ip_access_policy_manager≥ 17.5.0, ≤ 17.5.1—
f5/big-ip_access_policy_managerall versions—
References (2)
https://my.f5.com/manage/s/article/K000162605 · [email protected]https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 24 SEP 03:25Z
    EPSS moved — → 1%
    epss
  • 22 SEP 14:17Z
    BIG-IP APM OAuth vulnerability
    cvelistv5