CVE-2026-94127: F5 BIG-IP APM Heap Overflow Exploited, CISA KEV Deadline Imminent
CISA added CVE-2026-94127, a critical heap overflow in F5 BIG-IP APM, to KEV with a three-day remediation deadline after confirming in-the-wild exploitation. Unauthenticated attackers can achieve remote code execution on the data plane when an access policy and OAuth profile share a virtual server.
CVE-2026-94127: F5 BIG-IP APM Heap Overflow Exploited, CISA KEV Deadline Imminent
TL;DR
CVE-2026-94127 is a critical heap-based buffer overflow in F5 BIG-IP APM that allows unauthenticated remote code execution when an access policy and OAuth profile are configured on the same virtual server. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-22 with a remediation due date of 2026-09-25, confirming active exploitation. Apply the vendor-provided iRule for temporary mitigation and install the final patch immediately; if you cannot patch, restrict network access to affected virtual servers or discontinue use per CISA guidance.
What is this vulnerability?
- CVE ID: CVE-2026-94127
- Vendor / Product: F5 / BIG-IP APM (Access Policy Manager)
- Vulnerability Name: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
- Weakness: CWE-122 (Heap-based Buffer Overflow)
- CISA KEV Added: 2026-09-22
- CISA Due Date: 2026-09-25
- Known Ransomware Use: Unknown
- CVSS: 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0), both CRITICAL, per F5 SIRT
Overview
CVE-2026-94127 is a heap-based buffer overflow affecting F5 BIG-IP Access Policy Manager (APM). The flaw is triggered when a BIG-IP APM access policy and an OAuth profile are both configured on the same virtual server. Under those conditions, specific malicious traffic can lead to remote code execution (RCE). F5's Product Security Incident Response Team (SIRT) assigned dual CVSS scores: 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0, both rated CRITICAL. The vectors indicate a network attack vector, no privileges required, and no user interaction, meaning the vulnerability is reachable pre-authentication.
CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-22 with a remediation due date of 2026-09-25. This three-day window is unusually short and signals confirmed exploitation activity in the wild. Federal agencies and regulated entities subject to CISA's Binding Operational Directive (BOD) 26-04 must prioritize this update and follow the associated Forensics Triage Requirements. The KEV listing also serves as a strong signal for private-sector defenders to treat this as an emergency.
F5 notes that the vulnerability is a data plane issue: there is no control plane exposure. However, systems running in Appliance mode are also vulnerable. This broadens the set of environments that must respond, because Appliance mode is a common hardening configuration. Additionally, F5 states that software versions which have reached End of Technical Support (EoTS) were not evaluated. Organizations running unsupported branches may carry the same or related weakness without a formal assessment and should plan an upgrade to a supported release.
Defenders should care because BIG-IP APM frequently fronts authentication and access for internal applications. A compromise of the data plane can become a pivot point: an attacker may be positioned to observe or manipulate authentication flows, harvest credentials or tokens, and reach downstream applications that trust the BIG-IP as a gatekeeper. The combination of pre-authentication reachability, high impact, and confirmed exploitation makes this a top-priority remediation item.
Technical details
Root cause: The vulnerability is a heap-based buffer overflow (CWE-122) in the APM data plane handling path. It occurs when a buffer allocated on the heap is written past its bounds. The overflow is triggered by specific malicious traffic reaching the vulnerable code path on virtual servers where an access policy and an OAuth profile are configured together.
Vulnerable component: BIG-IP APM data plane. F5 explicitly states this is a data plane issue with no control plane exposure. Systems in Appliance mode are also vulnerable.
Attack prerequisites:
- The target virtual server must have both an APM access policy and an OAuth profile bound.
- The attacker must be able to send crafted requests to that listener.
- No authentication, no valid session, and no user interaction are required.
Network exposure: The attack vector is network-based (AV:N). The vulnerable service listens on the virtual server's configured ports, typically HTTPS (443) for OAuth-enabled access policies. Any virtual server with the combined configuration that is reachable from untrusted networks is at risk.
Affected versions: F5's advisory K000162605 provides version-specific guidance. Software versions that have reached End of Technical Support (EoTS) were not evaluated. Defenders should consult the advisory for the exact affected ranges and fixed releases.
Auth requirements: None. The CVSS vectors show PR:N (no privileges required) and UI:N (no user interaction). This is a pre-authentication vulnerability.
Impact
Successful exploitation yields remote code execution in the context of the BIG-IP data plane. The CVSS 3.1 vector rates confidentiality, integrity, and availability all as High (C:H/I:H/A:H). Defenders should assume an attacker could:
- Read sensitive session and policy material.
- Alter traffic handling and access decisions.
- Disrupt availability of the affected virtual server.
Because BIG-IP APM often serves as an authentication and access gateway for internal applications, a data plane compromise can become a pivot point. An attacker may be positioned to observe or manipulate authentication flows, harvest credentials or tokens, and reach downstream applications that trust the BIG-IP as a gatekeeper. This can lead to lateral movement and further compromise.
Business exposure includes regulatory and contractual obligations tied to CISA BOD 26-04 for federal and regulated entities, potential loss of trust in the access layer, and incident response costs driven by the need for forensic triage. The KEV listing and the three-day remediation window indicate that real-world exploitation is already occurring, so the practical impact is not theoretical.
Exploitability
CVE-2026-94127 is listed in CISA's KEV catalog, which confirms that exploitation has been observed in the wild. The due date of 2026-09-25 is only three days after the KEV addition, reflecting the urgency. F5 SIRT assigned a CVSS 3.1 score of 9.8 and a CVSS 4.0 score of 9.3, both CRITICAL. No public proof-of-concept or exploit code is referenced in the source intelligence, but the KEV listing itself is the strongest signal that attackers are actively exploiting this vulnerability. The EPSS score is not provided in the source data. Given the pre-authentication nature and the data plane exposure, any internet-facing BIG-IP APM virtual server with the combined access policy and OAuth profile configuration should be considered at immediate risk.
KEV vs CVSS vs EPSS
| Signal | What it measures | Action for this CVE |
|---|---|---|
| KEV | Confirmed in-the-wild exploitation | Treat as emergency; patch by 2026-09-25. Follow BOD 26-04 and Forensics Triage Requirements. |
| CVSS | Technical severity (9.8/9.3 CRITICAL) | Prioritize based on high impact (C/I/A all High) and network reachability. |
| EPSS | Probability of exploitation in next 30 days | Not provided in source data; KEV status supersedes. |
Exploitation steps (defensive triage)
- Inventory BIG-IP APM virtual servers and identify those where an access policy and an OAuth profile are configured together. This is the vulnerable configuration.
- Confirm network exposure for those virtual servers, including any listeners reachable from untrusted networks.
- Review F5 advisory K000162605 to confirm affected version ranges for your deployed branches, including whether your version is past End of Technical Support.
- Apply the vendor-provided iRule as a temporary mitigation to enable proactive forensic triage while you prepare the permanent patch.
- Hunt historical logs and traffic captures for anomalous requests to the affected virtual servers in the days before and after the KEV listing date.
- Install the final vendor patch as soon as it is available, then validate that the iRule mitigation has been removed or superseded.
- Re-run exposure checks to confirm no vulnerable virtual server remains reachable, and document the remediation timeline for BOD 26-04 compliance.
- Escalate to incident response if any evidence of successful exploitation is found, and preserve forensic artifacts per CISA's Forensics Triage Requirements.
Indicators of compromise
- Unexpected process execution or child processes spawned by BIG-IP data plane services on affected virtual servers.
- Outbound network connections from BIG-IP systems to unfamiliar external IP addresses or domains that do not match normal application traffic.
- Anomalous HTTP requests to virtual servers that combine APM access policy and OAuth profile configuration, especially malformed or oversized requests targeting OAuth-related endpoints.
- Crashes, restarts, or unexpected memory-related errors in BIG-IP data plane services, which can be a side effect of heap corruption attempts.
- New or modified files on the BIG-IP filesystem outside of normal configuration and update activity.
- Authentication anomalies such as unexpected token issuance, session creation without a legitimate login, or unusual OAuth grant activity.
- Changes to access policies, OAuth profiles, or iRules that were not made by authorized administrators.
- EDR or network telemetry showing repeated probing of the same virtual server from a single source in a short time window.
Mitigation and workarounds
F5 provides a temporary iRule that can be applied to reduce exposure and allow time for proactive forensic triage; this should be treated as a stopgap, not a fix. The primary remediation is to install the final vendor patch as soon as it is available, following F5's advisory K000162605 for version-specific guidance. Because EoTS versions were not evaluated, organizations running unsupported branches should plan an upgrade to a supported release rather than assume they are unaffected.
Where patching cannot be completed immediately, defenders should consider:
- Restricting network access to affected virtual servers.
- Disabling the combined access policy and OAuth profile configuration where operationally feasible.
- Increasing monitoring on the data plane.
CISA's BOD 26-04 guidance should be followed for prioritization, and cloud service usage should be reviewed against the same directive. If mitigations are unavailable, CISA's guidance includes discontinuing use of the affected product, which is a serious step that should be weighed against business dependency on BIG-IP APM.
After applying mitigations, verify their effectiveness by re-scanning for exposure and confirming that the iRule is active. Once the final patch is installed, remove the temporary iRule to avoid conflicts.
Community reactions
The KEV listing on 2026-09-22 with a due date of 2026-09-25 generated immediate urgency across the security community, since the three-day window is among the shortest seen for a KEV entry. F5's SIRT published dual CVSS scores (9.8 and 9.3) that both land in CRITICAL territory, reinforcing the severity message. Security media and vendor advisories have focused on the pre-authentication, data-plane nature of the flaw and the fact that Appliance mode is also affected, which broadens the set of environments that must respond. There is no public proof-of-concept or exploit code referenced in the source intelligence, but the KEV listing itself is the strongest signal that exploitation is occurring in the wild. Defenders have been sharing triage guidance around identifying virtual servers with combined access policy and OAuth profile configuration, and around applying the vendor iRule as an interim control.
FAQ
Q: Is CVE-2026-94127 in the CISA KEV catalog? A: Yes, it was added on 2026-09-22.
Q: What is the CISA remediation due date? A: 2026-09-25.
Q: Is this vulnerability exploitable over the internet? A: Yes, if a BIG-IP APM virtual server with an access policy and OAuth profile is reachable from untrusted networks. The attack vector is network-based and requires no authentication.
Q: Which F5 products are affected? A: F5 BIG-IP APM. The vulnerability is triggered when an access policy and an OAuth profile are configured on the same virtual server. Appliance mode is also vulnerable.
Q: How can I verify if my system is vulnerable? A: Check if your BIG-IP APM virtual servers have both an access policy and an OAuth profile configured. Consult F5 advisory K000162605 for affected version ranges.
Q: What is the temporary mitigation? A: F5 provides an iRule that can be applied as a stopgap while preparing to patch. Install the final vendor patch as soon as possible.
Q: Is there a public exploit? A: No public proof-of-concept or exploit code is referenced in the source intelligence, but active exploitation is confirmed by the KEV listing.
Q: What should I do if I cannot patch immediately? A: Apply the vendor iRule, restrict network access to affected virtual servers, and increase monitoring. If mitigations are unavailable, CISA guidance includes discontinuing use of the product.