CVE-2026-94127 is a heap overflow in F5 BIG-IP Access Policy Manager (APM), rated 9.8, published on September 22, 2026 and added to the CISA KEV catalog the same day, with a deadline of the 25th.
It's an unauthenticated RCE — but with a very precise exposure condition, which lets most BIG-IP customers find out quickly whether they're affected. That's where to start.
| Field | Value |
|---|---|
| CVSS 3.1 | 9.8 (CRITICAL) |
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CISA KEV added | 2026-09-22 |
| CISA deadline | 2026-09-25 |
The Condition That Decides Everything
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected.
Three cumulative conditions:
- APM is provisioned
- An access policy and an OAuth profile are attached to a virtual server
- APM acts as an OAuth authorization server — it issues tokens
The third point rules out many deployments. Most use APM as a client of an external identity provider (Entra ID, Okta, ADFS): they aren't vulnerable. Only those making BIG-IP their own OAuth token issuer are.
Checking in two minutes
In the Configuration utility:
Access › Federation › OAuth Authorization Server
If that list is empty, CVE-2026-94127 doesn't affect you. If it contains profiles, check whether they're attached to an active virtual server.
What F5 Specifies
This is a data plane issue; there is no control plane exposure. The BIG-IP system in Appliance mode is also vulnerable.
Two important points:
- Data plane: the attack arrives through traffic destined for the virtual server — the one exposed to users, often on the internet. Restricting the management interface does not protect against this flaw.
- Appliance mode: this hardened mode, which restricts shell access, is no protection here.
And a final note not to overlook:
Software versions which have reached End of Technical Support (EoTS) are not evaluated.
"Not evaluated" doesn't mean "not vulnerable". An out-of-support version with APM as an OAuth authorization server must be presumed vulnerable.
Versions
NVD lists these bounds for big-ip_access_policy_manager: 17.1.3, 17.5.1, 21.1.0. They're branch bounds, not necessarily the release to install — the corresponding F5 K-article gives the exact fixed version per branch.
tmsh show sys version
Detection
- Restarts of the
apmdprocess or TMM, and core files in/var/core— a failed heap overflow leaves a crash - Abnormal requests to the virtual server's OAuth endpoints (authorize, token): volumes, parameter sizes, unusual origins
- OAuth tokens issued outside the usual profile of client applications
- Unknown processes or files on the system
Mitigation
- If you have no OAuth Authorization Server profile: not affected by this CVE — but update in the normal cycle.
- If you have one: apply the fixed release for your branch immediately. Meanwhile, detaching the OAuth authorization server profile from exposed virtual servers, if the service can do without it temporarily, removes the exploitation condition.
- EoTS versions with this configuration: migrate to a supported branch.
- If you suspect compromise: rotate the signing keys of OAuth tokens issued by APM — that's what would let an attacker forge tokens accepted by every application trusting this server.
Why Continuous Monitoring of Application Delivery Gear Matters
A BIG-IP isn't just a load balancer: in many organisations it's also the identity provider for dozens of applications. Knowing which configuration runs on which device, at which version, is what turns a three-day CISA deadline into a two-minute check.
With cveo.tech, inventory your BIG-IPs and their modules with exact versions, and get alerted whenever a KEV-listed CVE affects them.