{"id":"f5-big-ip-apm-oauth-rce-sep-2026","category":"patch","status":"closed","title":"F5 BIG-IP APM remote code execution flaw CVE-2026-94127 exploited; hotfixes released","tldr":"F5 BIG-IP APM flaw CVE-2026-94127 (CVSS 9.8) lets attackers run code without logging in and is being exploited. Affects systems with an APM access policy and OAuth profile. IT teams: apply F5's hotfix for your branch, or ask F5 Support for the iRule workaround.","summary":"CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM), a gateway product businesses use to control remote access. An unauthenticated attacker who can reach an affected virtual server could run their own code on it. F5 disclosed it on 22 September 2026 and indicated it was already being exploited, and CISA listed it as exploited the same day. Only configurations with both an APM access policy and an OAuth profile on the same virtual server are exposed, and F5 says the control plane is not affected. Appliance mode systems are also vulnerable. F5 released engineering hotfixes for the 21.1, 17.5 and 17.1 branches. Customers who cannot patch straight away can ask F5 Support for an iRule workaround. Reports differ on the numbered point releases that carry the fix, and I could not read F5's advisory page directly. No later developments were found by early November. It is not known how many systems were compromised.","action":"If you run BIG-IP with APM, install the F5 hotfix for your branch (see K000162605) and check logs for signs of compromise first. Home users have nothing to do, but ask your IT provider if your work uses F5 remote access.","product":"F5 BIG-IP Access Policy Manager (APM)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-94127"],"tags":["f5","big-ip","apm","oauth","remote-code-execution","zero-day","cisa-kev"],"affected":["BIG-IP 21.1.0 (before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG)","BIG-IP 17.5.0 through 17.5.1 (before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG)","BIG-IP 17.1.0 through 17.1.3 (before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG)"],"fixed":["Hotfix-BIGIP-21.1.0.2.0.30.22-ENG","Hotfix-BIGIP-17.5.1.9.0.160.12-ENG","Hotfix-BIGIP-17.1.3.5.0.41.14-ENG"],"matches":[],"sources":[{"kind":"advisory","title":"K000162605: BIG-IP APM vulnerability CVE-2026-94127","url":"https://my.f5.com/manage/s/article/K000162605","by":"F5","date":"2026-09-22"},{"kind":"advisory","title":"Alert AL26-022 - Vulnerability impacting F5 BIG-IP Access Policy Manager (APM) – CVE-2026-94127","url":"https://cyber.gc.ca/en/alerts-advisories/al26-022-vulnerability-impacting-f5-big-ip-access-policy-manager-apm-cve-2026-94127","by":"Canadian Centre for Cyber Security","date":"2026-09-22"},{"kind":"research","title":"CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM","url":"https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm/","by":"Rapid7","date":"2026-09-22"},{"kind":"news","title":"F5 BIG-IP Zero-Day Under Active Attack as Sept. 25 CISA Deadline Looms","url":"https://www.esecurityplanet.com/news/f5-big-ip-zero-day/","by":"eSecurity Planet","date":"2026-09-23"}],"started":"2026-09-22","closed":"2026-09-23","created":"2026-11-03T22:08:08.438Z","updated":"2026-11-03T22:08:08.438Z","cve_notes":[{"cve":"CVE-2026-94127","name":"Heap buffer overflow in F5 BIG-IP APM OAuth handling","what":"A heap-based buffer overflow in BIG-IP Access Policy Manager, triggered on virtual servers with an APM access policy and OAuth profile, that lets an unauthenticated attacker run code on the device.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-09-23","added":"2026-11-03T22:05:27.736Z","kind":"other","text":"eSecurity Planet reported CERT-EU's advice to look for repeated OAuth sign-in failures, suspicious audit-log commands and TMM crashes (SIGABRT), and to preserve evidence before fixing.","url":"https://www.esecurityplanet.com/news/f5-big-ip-zero-day/","by":"eSecurity Planet","patch":null},{"at":"2026-09-22","added":"2026-11-03T22:05:27.736Z","kind":"other","text":"Rapid7 confirmed the scope: only systems with both an APM access policy and an OAuth profile on one virtual server are exposed. It noted that F5 offers an iRule workaround through a support case and that a public proof of concept was not confirmed.","url":"https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm/","by":"Rapid7","patch":null},{"at":"2026-09-22","added":"2026-11-03T22:05:27.736Z","kind":"cisa-added","text":"CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities list. US federal civilian agencies were given until 25 September to fix it.","url":"https://www.esecurityplanet.com/news/f5-big-ip-zero-day/","by":"eSecurity Planet","patch":null},{"at":"2026-09-22","added":"2026-11-03T22:05:27.736Z","kind":"disclosed","text":"F5 published advisory K000162605 for CVE-2026-94127, a heap-based buffer overflow in BIG-IP APM that lets an unauthenticated attacker run code. F5 indicated it was already being exploited, and released engineering hotfixes for the 21.1, 17.5 and 17.1 branches.","url":"https://cyber.gc.ca/en/alerts-advisories/al26-022-vulnerability-impacting-f5-big-ip-access-policy-manager-apm-cve-2026-94127","by":"Canadian Centre for Cyber Security","patch":"patched"}],"url":"https://hard.fyi/live/f5-big-ip-apm-oauth-rce-sep-2026/","json":"https://hard.fyi/api/live?id=f5-big-ip-apm-oauth-rce-sep-2026"}