CVE-2026-94127

BIG-IP APM OAuth vulnerability

Published: Sep 22, 2026Updated: Sep 23, 2026 Sources: CVE List NVDCWE-122

9.8CRITICAL

Description

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

In plain language

AI Act now

BIG-IP systems using APM as an OAuth Authorization Server are at critical risk and need urgent action.

Executive summary

Unauthenticated network-based remote code execution in F5 BIG-IP APM caused by a CWE-122 memory error when an access policy and OAuth Authorization Server profile are configured on a virtual server.

If affected, business impact

Full BIG-IP takeoverCustomer traffic interceptionService disruptionSensitive data exposureRansomware risk

What to do now

Check whether each BIG-IP virtual server uses APM with both an access policy and an OAuth profile configured as an OAuth Authorization Server.
If it does, identify the BIG-IP software branch currently installed and assess whether the affected virtual server is exposed to untrusted networks.
Install the applicable F5 hotfix: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG.
If the hotfix cannot be installed immediately, open an F5 support ticket to request the available iRule workaround.
Preserve relevant BIG-IP logs and have IT investigate the device for suspicious activity.

Usually a quick update

What is it

This is a flaw in a BIG-IP traffic-management feature that can let an outsider take control of the device. Think of it as an attacker finding an unlocked service entrance that gives them the master keys to the building.

Who is affected

This matters to you if you run BIG-IP with Access Policy Manager (APM) configured as an OAuth Authorization Server. BIG-IP deployments using APM only as an OAuth client or resource server are not affected. It is only a risk when an APM access policy and OAuth Authorization Server profile are configured together on a virtual server.

How urgent is it

Attackers are already exploiting this vulnerability, so treat it as an emergency. CISA added it to its Known Exploited Vulnerabilities catalog on September 22, 2026, with remediation due September 25, 2026.

What to do — in detail

Confirm exposure by reviewing BIG-IP virtual-server configuration for APM access policies paired with OAuth profiles operating as an OAuth Authorization Server. Systems used strictly as OAuth clients or resource servers are outside the affected configuration.

For the applicable installed branch, deploy Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. Validate the hotfix against the installed BIG-IP branch with F5 support or vendor documentation before deployment.

If patching is delayed, request F5's iRule workaround through an F5 support ticket. CISA's remediation due date is September 25, 2026. Preserve BIG-IP logs and investigate for suspicious requests, unexpected command execution, configuration changes, or unusual outbound connections before and after remediation.

Technical context

CVE-2026-94127 is CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is an unauthenticated, no-user-interaction network attack against a CWE-122 memory error in BIG-IP APM, enabling arbitrary code execution when a virtual server has both an access policy and an OAuth Authorization Server profile. The issue is not enabled in the default configuration and does not affect APM deployments operating strictly as OAuth clients or resource servers. CISA KEV listing indicates confirmed exploitation in the wild; no public exploit code is on record. No EPSS finding was provided.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-122

Affected Products

commercial·US

big-ip access policy managerOn-premNetwork Device

Networking Infrastructure / firewall

BIG-IPOn-premNetwork Device

Networking Infrastructure / router-switch

Exploitability

CISA Known Exploited Vulnerability

Added to KEV:Sep 22, 2026

Remediation due:Sep 25, 2026

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Official Patch Available

Workaround Available

Is your org exposed to CVE-2026-94127?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Privilege Escalation

View detailed technique mapping

References

https://my.f5.com/manage/s/article/K000162605

my.f5.com

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127

cisa.gov

News mentions

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-94127 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows