A critical security vulnerability affecting certain F5 BIG-IP Access Policy Manager (APM) configurations is being actively exploited, creating an urgent patching priority for organisations using the affected systems. The flaw, tracked as CVE-2026-94127, has been added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue and carries a CVSS 4.0 score of 9.3 out of 10.
The vulnerability is particularly serious because successful exploitation can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable BIG-IP appliance. Since BIG-IP systems are commonly positioned at important network boundaries, compromising one could potentially provide attackers with access to sensitive information and opportunities to move further into the organisation's environment.
The Vulnerability Only Affects Specific APM Configurations
CVE-2026-94127 does not affect every BIG-IP deployment. According to the advisory, the vulnerability is present specifically when BIG-IP APM is configured as an OAuth Authorization Server. Systems using APM solely as an OAuth Client or OAuth Resource Server are not affected by this particular issue.
That distinction is important because organisations should not assume that the presence of BIG-IP APM automatically means they are vulnerable. Administrators first need to determine how OAuth functionality is configured and whether an affected virtual server is operating in the vulnerable role.
The issue is located in the system's data plane rather than the control plane, narrowing the conditions required for exploitation but still leaving affected internet-facing services at considerable risk.
A Heap-Based Buffer Overflow Is at the Centre of the Problem
The underlying vulnerability is described as a heap-based buffer overflow. It can be triggered when a BIG-IP virtual server has both an APM access policy and an OAuth profile configured to operate as an OAuth Authorization Server.
An attacker can send specially crafted traffic to that virtual server and cause data to exceed the intended memory buffer. If successfully exploited, that memory corruption can be leveraged to execute arbitrary commands on the appliance.
Buffer-overflow vulnerabilities are particularly dangerous in exposed infrastructure because exploitation may not require a valid account or existing access to the environment. In this case, the advisory specifically identifies the attack as unauthenticated remote code execution, significantly raising the urgency for organisations running affected configurations.
Successful Exploitation Could Lead to Full System Compromise
Once remote code execution is achieved, an attacker may gain the ability to execute commands on the vulnerable appliance. The potential impact includes complete compromise of the affected system, unauthorised access to information and lateral movement into other parts of the network.
This is particularly concerning for devices positioned at the network edge. Security appliances, gateways and access-management systems frequently sit between external users and internal services, which means compromising one can provide attackers with a strategically valuable position.
A vulnerable edge appliance can potentially become both the initial point of entry and a platform from which additional systems are explored. For defenders, this makes rapid remediation considerably more important than waiting for signs of compromise to appear.
F5 Has Confirmed Active Exploitation
The threat is not theoretical. F5 has confirmed that CVE-2026-94127 is being actively exploited in the wild, and CISA's decision to add the vulnerability to its KEV catalogue further reinforces that real attackers are already taking advantage of it.
Active exploitation changes the normal patching calculation. A vulnerability with a critical severity score may ordinarily enter an organisation's scheduled remediation process, but one already being used by attackers deserves much faster attention.
The advisory notes that it is currently unknown whether the flaw is being exploited as part of any active ransomware campaign.
That uncertainty should not reduce the urgency. Remote code execution on a perimeter system can support many forms of intrusion, whether the eventual objective is ransomware, espionage, data theft or persistent unauthorised access.
Which BIG-IP Versions Are Vulnerable?
The advisory identifies several affected BIG-IP APM branches. The vulnerable versions listed include:
The vulnerable component is specifically APM OAuth.
Importantly, the advisory states that all other BIG-IP modules and BIG-IQ Centralized Management are not affected by this vulnerability.
Administrators should therefore verify both the installed BIG-IP version and the precise feature configuration before determining exposure.
Hotfixes Are Available and Should Be Applied Urgently
F5 has released engineering hotfixes for the affected branches, and administrators are advised to identify the version currently running in their environment and install the applicable fix if the deployment is vulnerable.
The listed fixes are:
The advisory states that these hotfixes fully mitigate the vulnerability.
For affected environments, patching should therefore be treated as the preferred remediation rather than relying indefinitely on temporary controls.
A Temporary iRule Mitigation Is Available
Some organisations may not be able to install an engineering hotfix immediately because the appliance supports critical production traffic and changes need to go through testing or maintenance windows.
For those situations, F5 has provided a temporary iRule mitigation that can be applied to the affected BIG-IP APM virtual server. Organisations that cannot patch immediately are advised to contact F5 Support to obtain and implement the temporary measure.
The iRule should be viewed as a short-term risk-reduction measure rather than a substitute for updating the appliance. Once operational constraints allow it, affected systems should still move to the appropriate fixed version.
Administrators Should Verify Configuration Before Assuming Safety
Because the vulnerability exists only under specific OAuth conditions, administrators should verify their configurations rather than relying only on software inventory.
A system running one of the listed versions may not be vulnerable if APM is not operating as an OAuth Authorization Server. Conversely, a system that exposes the affected configuration externally may represent a particularly attractive target because exploitation does not require authentication.
A practical review should therefore establish three things:
These checks can help security teams identify the highest-priority systems while patches are being deployed.
Why Edge-System Vulnerabilities Require Fast Action
A critical flaw in an ordinary workstation is serious, but a remote-code-execution vulnerability in a network access platform carries additional consequences. These devices often handle authentication, remote connectivity and traffic entering the organisation, placing them in a highly privileged position.
An attacker who compromises a boundary device may gain visibility or access that would otherwise require multiple stages of intrusion. The appliance could potentially become a foothold for reconnaissance and lateral movement deeper into the network.
That makes vulnerabilities such as CVE-2026-94127 particularly valuable to attackers and explains why active exploitation should immediately influence remediation priorities.
Organisations Should Also Look for Signs of Previous Exploitation
Applying the hotfix protects against future exploitation, but organisations running an affected configuration should also consider whether the appliance may have already been targeted before remediation.
Because exploitation can lead to arbitrary command execution and system compromise, patching alone does not prove that the environment is clean. Organisations with exposed vulnerable systems may want to review available logs, authentication activity and unusual system behaviour around the affected appliances.
The source document focuses primarily on remediation rather than providing a detailed compromise-hunting procedure, so organisations requiring deeper forensic guidance should follow F5's official incident-response documentation and their established security procedures.
Final Thoughts
CVE-2026-94127 deserves immediate attention because it combines three characteristics defenders never want to see together: critical severity, unauthenticated remote code execution and confirmed active exploitation.
The scope is narrower than a vulnerability affecting every BIG-IP installation, since the issue specifically requires BIG-IP APM to be configured as an OAuth Authorization Server. That should help organisations rapidly determine whether their systems are exposed.
For vulnerable environments, the response is straightforward. Identify the affected version and configuration, apply the appropriate F5 hotfix as quickly as operationally possible, and use the temporary iRule mitigation where immediate patching cannot be performed.
Network-boundary infrastructure should always receive special attention when actively exploited flaws emerge. In this case, the ability for an unauthenticated attacker to execute code means waiting for the next routine maintenance cycle could leave an unnecessary window of exposure.
The safest approach is to determine exposure now and remediate it before an attacker does the checking for you.
Comments 0