Summary
generated automatically from NVD dataF5 BIG-IP Access Policy Manager (APM) has a heap-based buffer overflow flaw (CWE-122) that can give an unauthenticated remote attacker code execution through specially crafted traffic. It only applies when an access policy and an OAuth profile are configured on a virtual server and APM acts as an OAuth Authorization Server; systems in Appliance mode are also vulnerable. It is a data plane issue with no control plane exposure, is listed in the CISA KEV catalog, and has a CVSS v3.1 score of 9.8 (CRITICAL).
NVD description
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-22. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-09-25
EPSS · FIRST.org
2.2%probability of exploitation in the next 30 days
Higher than 82% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 22 sept. 2026
- Updated
- 23 sept. 2026
- Status
- Analyzed
- Source
- f5sirt@f5.com
Affected products
Weaknesses (CWE)
References (2)
- https://my.f5.com/manage/s/article/K000162605Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-122
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.