F5 BIG-IP APM Heap-based Buffer Overflow (CVE-2026-94127)

Catalog analysis: CISA added this entry on September 22, 2026. The entry reflects catalog information retrieved on September 23, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-94127 is a heap-based buffer overflow (CWE-122) identified in F5 BIG-IP APM. This flaw could allow an unauthenticated remote attacker to achieve remote code execution (RCE). Due to the potential for unauthenticated access and execution, CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on September 22, 2026.

Exposure and applicability

Not all F5 BIG-IP APM installations are susceptible. The vulnerability is applicable only when the following conditions are met on a virtual server:
* An access policy is configured.
* An OAuth profile is configured.

Infrastructure owners should prioritize assets that meet both criteria and are exposed to the internet, as these represent the highest risk of exploitation.

Remediation priorities

Based on the available data, we recommend a phased approach to remediation to balance immediate risk reduction with the need for security visibility.

1. Temporary Mitigation and Triage: Deploy the vendor-provided iRule. This is intended as a temporary measure that allows organizations to perform proactive forensic triage before the system state is altered by a patch.
2. Permanent Remediation: Install the final vendor patch. This should be performed immediately following the completion of any required forensic analysis.

For federal agencies, CISA has established a remediation deadline of September 25, 2026.

How to validate remediation

Verification must move beyond simple version checks to ensure the vulnerability is actually mitigated in the running environment.

• Configuration Audit: Confirm whether OAuth profiles and access policies are active on virtual servers. If these configurations are removed or disabled, the specific attack vector for CVE-2026-94127 is eliminated, though this may impact business functionality.
• Control Verification: Verify that the vendor iRule is actively applied to all vulnerable virtual servers during the triage phase.
• Patch Validation: Confirm the successful application of the final vendor patch across all affected BIG-IP APM instances.

Limits and open questions

While the vulnerability is listed in the KEV catalog, it remains unknown whether this flaw has been utilized specifically in ransomware campaigns. Additionally, while the iRule provides temporary mitigation, it does not resolve the underlying heap-based buffer overflow; only the final vendor patch addresses the root cause.

Residual risk remains if forensic triage is skipped or if patches are applied to some but not all virtual servers meeting the OAuth and access policy criteria.

Source and editorial note

CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability · Source date: September 22, 2026 · Retrieved September 23, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment