CVE-2026-94127: F5 BIG-IP APM OAuth Server RCE Flaw

CVE-2026-94127 Overview

CVE-2026-94127 is a remote code execution vulnerability in F5 BIG-IP Access Policy Manager (APM). The flaw exists when a BIG-IP APM access policy and an OAuth profile are configured together on a virtual server. Specific malicious traffic sent to that virtual server can trigger remote code execution on the appliance. The vulnerability affects only deployments where BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client or Resource Server are not affected. The vulnerability is classified as a heap-based buffer overflow [CWE-122] and is exploitable by an unauthenticated attacker across the network. CISA has added CVE-2026-94127 to the Known Exploited Vulnerabilities catalog.

Critical Impact
Unauthenticated attackers can achieve remote code execution on the BIG-IP data plane, including systems running in Appliance mode.

Affected Products

F5 BIG-IP Access Policy Manager (APM) — configurations acting as OAuth Authorization Server
F5 BIG-IP Access Policy Manager version 21.1.0
F5 BIG-IP systems running in Appliance mode with the affected APM configuration

Discovery Timeline

2026-09-22 - CVE-2026-94127 published to NVD
2026-09-23 - Last updated in NVD database
2026-09-24 - EPSS scoring data published

Technical Details for CVE-2026-94127

Vulnerability Analysis

CVE-2026-94127 is a heap-based buffer overflow [CWE-122] in the OAuth Authorization Server functionality of BIG-IP APM. The vulnerability is triggered when the OAuth profile processes attacker-controlled request data on a virtual server that also has an APM access policy attached. Exploitation results in arbitrary code execution in the context of the affected data plane process. F5 states the issue is confined to the data plane, with no control plane exposure. Systems in Appliance mode, which normally restrict administrative shell access, remain vulnerable because the flaw is reached through the network-facing OAuth handler rather than management interfaces.

Root Cause

The underlying weakness is improper bounds checking in the OAuth Authorization Server code path. When crafted OAuth request data is parsed, memory allocated on the heap is written beyond its intended size. This heap corruption can be leveraged to hijack control flow and execute attacker-supplied instructions. Only virtual servers configured with both an APM access policy and an OAuth Authorization Server profile expose the vulnerable code path.

Attack Vector

Exploitation requires only network access to an affected virtual server. No authentication, user interaction, or prior foothold is needed. An attacker sends specifically crafted OAuth traffic to a virtual server that has both an APM access policy and an OAuth Authorization Server profile bound to it. Successful exploitation yields code execution on the BIG-IP data plane. Because BIG-IP frequently sits at the network perimeter, exposure of the affected virtual servers is often direct from the internet.

No public proof-of-concept code is available in verified repositories at this time. See the F5 Support Article K000162605 for vendor technical details.

Detection Methods for CVE-2026-94127

Indicators of Compromise

Unexpected process crashes, core dumps, or restarts of APM data plane processes (tmm, APM daemons) on affected BIG-IP systems
Anomalous outbound network connections originating from BIG-IP devices, including reverse shells or unexpected DNS lookups
Unusual OAuth authorization endpoint traffic containing oversized or malformed parameters targeting virtual servers with APM access policies
Modifications to configuration files, cron jobs, or startup scripts on the BIG-IP appliance that were not initiated by authorized administrators

Detection Strategies

Inventory all BIG-IP virtual servers and identify those with both an APM access policy and an OAuth Authorization Server profile applied
Enable and forward BIG-IP APM and system logs to a centralized analytics platform for correlation of crashes with inbound OAuth traffic
Deploy network signatures on inline security appliances to inspect OAuth authorization requests for abnormal length or structure
Monitor for new or unexplained shell processes, file writes, or listener sockets on BIG-IP hosts, including systems in Appliance mode

Monitoring Recommendations

Continuously monitor F5 and CISA KEV advisories for updates to CVE-2026-94127 guidance and indicators
Track authentication and administrative activity on BIG-IP management interfaces for signs of post-exploitation lateral movement
Baseline OAuth request volume and error rates per virtual server, alerting on statistically significant deviations

How to Mitigate CVE-2026-94127

Immediate Actions Required

Apply the fixed BIG-IP APM software versions listed in F5 Support Article K000162605 as soon as change windows allow
Identify every virtual server that has both an APM access policy and an OAuth Authorization Server profile bound, and prioritize patching those systems first
Restrict network exposure of affected virtual servers to trusted client networks until patching is complete
Review BIG-IP logs and system state for signs of prior exploitation, given that the vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog

Patch Information

F5 has published remediation details in F5 Support Article K000162605. Administrators should upgrade affected BIG-IP APM installations to a fixed release identified in that advisory. Software versions that have reached End of Technical Support (EoTS) are not evaluated by F5 and should be upgraded to a supported branch. CISA KEV listing carries federal remediation deadlines for U.S. government agencies; see the CISA Known Exploited Vulnerabilities entry.

Workarounds

If patching cannot occur immediately, remove the OAuth Authorization Server profile from affected virtual servers where the OAuth Authorization Server role is not required
Reconfigure APM deployments to act only as an OAuth Client or Resource Server, which is not affected by this vulnerability
Place upstream Layer 7 controls in front of BIG-IP APM virtual servers to filter malformed OAuth requests and block known exploitation patterns

bash

# Configuration example: identify BIG-IP virtual servers with both an APM access
# policy and an OAuth authorization server profile attached. Run from the BIG-IP CLI.
tmsh list ltm virtual one-line | \
  grep -E 'profiles .*oauth' | \
  grep -E 'profiles .*access'