Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-94127

Published 2026-09-22

Updated last month

Vendor/s

F5

Product/s

BIG-IP APM

Version/s

17.0.0 > 17.1.3

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

9.8

/ 10

Critical

Severity Details

Base score

9.8 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-94127 is a critical RCE vulnerability in F5 BIG-IP APM (CVSS 9.8) actively exploited in the wild. Patch affected systems immediately.

## Why this matters

"CVE-2026-94127 is a critical remote code execution (RCE) vulnerability in F5 BIG-IP Access Policy Manager (APM) with a CVSS score of 9.8. It is currently listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. The flaw allows unauthenticated attackers to execute arbitrary code via malicious network traffic when the system is configured as an OAuth Authorization Server. Because this affects the data plane, it poses a severe risk to organizational infrastructure, even in Appliance mode. Security teams must prioritize this update immediately to prevent full system compromise and unauthorized access to sensitive network resources."

## CPE

F5

| Product                         | Version Start | Version End (excl.) | Status     |
| ------------------------------- | ------------- | ------------------- | ---------- |
| big-ip\_access\_policy\_manager | 17.0.0        | 17.1.3              | vulnerable |
| big-ip\_access\_policy\_manager | 17.5.0        | 17.5.1              | vulnerable |
| big-ip\_access\_policy\_manager | 21.1.0        | 21.1.0              | vulnerable |

## Related weakness (CWE)

CWE-122

## Remediation plan

1

### Apply official patches

Install the latest security updates provided by F5 for BIG-IP APM. If immediate patching is not possible, apply the vendor-recommended iRule mitigation as a temporary measure to block malicious OAuth traffic.

2

### Update affected systems

Ensure all BIG-IP APM instances running vulnerable versions—specifically 17.0.0 through 17.1.3, 17.5.0 through 17.5.1, and 21.1.0—are upgraded to a fixed release as specified in F5 advisory K000162605.

3

### Restrict access

Review virtual server configurations and limit access to OAuth Authorization Server profiles. If OAuth authorization functionality is not required, disable the profile or restrict network access to trusted IP ranges to reduce the attack surface.

4

### Monitor for exploitation

Conduct forensic triage on BIG-IP systems following CISA’s Forensics Triage Requirements. Inspect data plane logs for unusual OAuth request patterns or unexpected process executions that may indicate an attempted RCE.

## Detection Guidance

"Monitor BIG-IP logs for anomalous OAuth requests and malformed traffic targeting the APM data plane. Look for heap overflow indicators (CWE-122) or unexpected crashes in the TMM (Traffic Management Microkernel) process. Security teams should deploy network signatures to identify suspicious OAuth authorization flows and utilize F5’s provided scripts or iRules to log and intercept potentially malicious payloads before they reach the vulnerable component."

## References

[https://my.f5.com/manage/s/article/K000162605 Vendor Advisory ](https://my.f5.com/manage/s/article/K000162605)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-94127 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)