NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

F5 BIG-IP APM remote code execution flaw CVE-2026-94127 exploited; hotfixes released

F5 BIG-IP APM flaw CVE-2026-94127 (CVSS 9.8) lets attackers run code without logging in and is being exploited. Affects systems with an APM access policy and OAuth profile. IT teams: apply F5's hotfix for your branch, or ask F5 Support for the iRule workaround.

What to do

If you run BIG-IP with APM, install the F5 hotfix for your branch (see K000162605) and check logs for signs of compromise first. Home users have nothing to do, but ask your IT provider if your work uses F5 remote access.

What’s happening

CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM), a gateway product businesses use to control remote access. An unauthenticated attacker who can reach an affected virtual server could run their own code on it. F5 disclosed it on 22 September 2026 and indicated it was already being exploited, and CISA listed it as exploited the same day. Only configurations with both an APM access policy and an OAuth profile on the same virtual server are exposed, and F5 says the control plane is not affected. Appliance mode systems are also vulnerable. F5 released engineering hotfixes for the 21.1, 17.5 and 17.1 branches. Customers who cannot patch straight away can ask F5 Support for an iRule workaround. Reports differ on the numbered point releases that carry the fix, and I could not read F5's advisory page directly. No later developments were found by early November. It is not known how many systems were compromised.

What
Flaw
Affects
F5 BIG-IP Access Policy Manager (APM)
Affected
BIG-IP 21.1.0 (before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG)
BIG-IP 17.5.0 through 17.5.1 (before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG)
BIG-IP 17.1.0 through 17.1.3 (before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG)
Fixed in
Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
CVE
CVE-2026-94127
Since
22 Sept 2026
Closed
23 Sept 2026

Timeline

  1. Update

    eSecurity Planet reported CERT-EU's advice to look for repeated OAuth sign-in failures, suspicious audit-log commands and TMM crashes (SIGABRT), and to preserve evidence before fixing.

  2. Update

    Rapid7 confirmed the scope: only systems with both an APM access policy and an OAuth profile on one virtual server are exposed. It noted that F5 offers an iRule workaround through a support case and that a public proof of concept was not confirmed.

  3. CISA added

    CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities list. US federal civilian agencies were given until 25 September to fix it.

  4. Made publicFixed

    F5 published advisory K000162605 for CVE-2026-94127, a heap-based buffer overflow in BIG-IP APM that lets an unauthenticated attacker run code. F5 indicated it was already being exploited, and released engineering hotfixes for the 21.1, 17.5 and 17.1 branches.

Sources

  1. K000162605: BIG-IP APM vulnerability CVE-2026-94127F5 · 22 Sept 2026
  2. Alert AL26-022 - Vulnerability impacting F5 BIG-IP Access Policy Manager (APM) – CVE-2026-94127Canadian Centre for Cyber Security · 22 Sept 2026
  3. CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APMRapid7 · 22 Sept 2026
  4. F5 BIG-IP Zero-Day Under Active Attack as Sept. 25 CISA Deadline LoomseSecurity Planet · 23 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from September 2026 · JSON · RSS