CVE-2026-94127
Description
CVE-2026-94127 is a critical RCE vulnerability in F5 BIG-IP APM (CVSS 9.8) actively exploited in the wild. Patch affected systems immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| big-ip_access_policy_manager | 17.0.0 | 17.1.3 | vulnerable |
| big-ip_access_policy_manager | 17.5.0 | 17.5.1 | vulnerable |
| big-ip_access_policy_manager | 21.1.0 | 21.1.0 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Install the latest security updates provided by F5 for BIG-IP APM. If immediate patching is not possible, apply the vendor-recommended iRule mitigation as a temporary measure to block malicious OAuth traffic.
Update affected systems
Ensure all BIG-IP APM instances running vulnerable versions—specifically 17.0.0 through 17.1.3, 17.5.0 through 17.5.1, and 21.1.0—are upgraded to a fixed release as specified in F5 advisory K000162605.
Restrict access
Review virtual server configurations and limit access to OAuth Authorization Server profiles. If OAuth authorization functionality is not required, disable the profile or restrict network access to trusted IP ranges to reduce the attack surface.
Monitor for exploitation
Conduct forensic triage on BIG-IP systems following CISA’s Forensics Triage Requirements. Inspect data plane logs for unusual OAuth request patterns or unexpected process executions that may indicate an attempted RCE.
Detection Guidance
"Monitor BIG-IP logs for anomalous OAuth requests and malformed traffic targeting the APM data plane. Look for heap overflow indicators (CWE-122) or unexpected crashes in the TMM (Traffic Management Microkernel) process. Security teams should deploy network signatures to identify suspicious OAuth authorization flows and utilize F5’s provided scripts or iRules to log and intercept potentially malicious payloads before they reach the vulnerable component."