CVE-2026-94127: F5 BIG-IP APM Heap Buffer Overflow Enables Unauthenticated Remote Code Execution

Background

F5 BIG-IP Access Policy Manager (APM) is an access-control and identity-aware proxy module that runs on F5’s BIG-IP platform, widely deployed at the network edge of enterprises to broker authenticated access to internal applications — VPN-style remote access, single sign-on, and OAuth/OIDC-based application access are core APM use cases. Because APM sits directly on the path between the public internet and internal applications, and because it is the component making access-control decisions, it is one of the most sensitive pieces of infrastructure in a typical enterprise network perimeter.

BIG-IP devices in general have a long history of being high-value targets for both opportunistic and targeted attackers precisely because compromising the device grants a foothold with direct visibility into — and often control over — all traffic the device proxies.

Technical Mechanism

CVE-2026-94127 is a heap-based buffer overflow, CWE-122, that occurs specifically when a BIG-IP virtual server has both an access policy and an OAuth profile configured. F5’s description indicates that processing of a request against this specific configuration combination (access policy + OAuth profile on the same virtual server) triggers memory allocation and copy operations that do not correctly bound the amount of data written into a heap-allocated buffer.

Mechanically, this class of bug typically unfolds as follows:

1. An attacker sends a request to a BIG-IP virtual server configured with APM access policy enforcement and an OAuth profile — for example, a request touching the OAuth authorization or token-handling code path
2. Attacker-influenced data (such as header values, token contents, or OAuth protocol fields) is copied into a heap buffer sized based on an incorrect or unchecked length calculation
3. The resulting heap overflow corrupts adjacent heap metadata or neighboring allocated objects
4. Depending on heap layout and the specific objects corrupted, the attacker can hijack control flow or manipulate function pointers/object state to achieve remote code execution within the BIG-IP traffic management process

F5’s advisory confirms the vulnerability “could allow an unauthenticated attacker to perform remote code execution” — no credentials or prior session are required, since the OAuth profile code path is reachable by design before a user has an established, authenticated APM session (OAuth flows begin unauthenticated by definition). The CVSS 3.1 base score of 9.8 is consistent with network-reachable, low-complexity, no-privilege, no-interaction exploitation with complete impact.

Real-World Exploitation Evidence

CVE-2026-94127 was added to CISA’s KEV catalog on 2026-09-22, confirming observed real-world exploitation. CISA set a remediation deadline of 2026-09-25 — a three-day window, indicating the urgency CISA assigned given the unauthenticated RCE impact and BIG-IP’s typical internet-facing deployment posture.

The KEV record lists knownRansomwareCampaignUse as “Unknown.” CISA has not confirmed ransomware campaign use of this vulnerability at this time; this should be read as “not yet confirmed,” not as “ruled out.”

No specific threat actor or campaign has been publicly attributed to exploitation of CVE-2026-94127 in the data available for this analysis. F5 BIG-IP vulnerabilities of this class (unauthenticated RCE on an internet-facing access-control appliance) have historically drawn interest from a wide range of actors — from opportunistic scanning operations to more targeted intrusion sets — but no attribution specific to this CVE should be assumed absent public confirmation from F5, CISA, or an established threat intelligence vendor.

Impact Assessment

Remote code execution on a BIG-IP device running APM gives an attacker code execution within the traffic management infrastructure that brokers access to internal applications. Practical consequences include:

• Session and credential interception — APM processes authentication and OAuth token flows; code execution on the device can expose session tokens, OAuth access/refresh tokens, and SSO assertions for every user authenticating through the compromised virtual server
• Internal network pivot — BIG-IP devices typically sit with one interface facing the internet and others facing internal application networks, making a compromised device a natural pivot point past the perimeter
• Traffic manipulation — an attacker with code execution on the traffic management process can potentially modify, redirect, or inspect traffic for every application proxied through that virtual server
• Full confidentiality/integrity/availability loss, consistent with the 9.8 CVSS score, since RCE on the device itself removes any remaining trust boundary

Sector-specific risk: Because APM is commonly used for VPN-style remote access and SSO to internal line-of-business applications, organizations in finance, healthcare, and government — sectors that rely heavily on F5 for secure remote access — face elevated risk of credential and session compromise leading to downstream access to internal systems that APM was meant to protect.

Affected Versions

F5’s temporary-mitigation guidance (an iRule) referenced in the vendor advisory implies the vulnerability affects BIG-IP APM releases where virtual servers can combine an access policy with an OAuth profile — this spans multiple BIG-IP software branches. The exact affected and fixed version table is published by F5 and should be treated as authoritative:

Organizations should confirm their specific BIG-IP version against F5’s published advisory rather than relying on inference from the KEV summary alone.

Remediation Steps

CISA’s required action is to apply vendor mitigations per F5’s instructions, in compliance with BOD 26-04 and Forensics Triage Requirements guidance, or to discontinue use of the product if mitigation is unavailable.

1. Apply F5’s temporary mitigation first if immediate patching isn’t possible — F5 published a vendor-provided iRule specifically to allow proactive forensic triage ahead of full patching:

# Example concept: F5 iRule applied to the affected virtual server
# to restrict or sanitize the vulnerable OAuth/access-policy request path
# pending the full software patch. Obtain the exact iRule from F5 article K000162605.
when HTTP_REQUEST {
    # Apply vendor-provided mitigation logic here per K000162605
}

2. Install the final F5-provided software patch as soon as possible after applying the temporary mitigation — the iRule is explicitly a stopgap, not a permanent fix.
3. Identify every virtual server combining an access policy and an OAuth profile across the BIG-IP fleet, since this is the specific trigger condition:

# Example: list virtual servers with both an access-policy and OAuth profile bound
tmsh list ltm virtual one-line | grep -i "access-policy\|oauth"

4. Restrict management and APM-facing interfaces from unnecessary internet exposure while patching is completed.
5. Conduct forensic triage on any instance that was internet-exposed and unpatched during the KEV-confirmed exploitation window, per CISA’s Forensics Triage Requirements.

Detection Guidance

F5 and CISA have not published a specific network-level exploitation signature in the data available for this analysis; organizations should monitor F5’s security advisory and their IDS/IPS vendor’s signature feed for CVE-2026-94127-specific rules.

General indicators worth reviewing in the interim:

• Crash or restart events in the BIG-IP traffic management process (tmm) correlating with requests to OAuth-enabled virtual servers
• Anomalous or malformed OAuth request parameters (oversized header values, malformed token fields) in virtual server access logs
• Unexpected process spawning or outbound connections originating from the BIG-IP appliance itself, which would indicate successful post-exploitation activity
• Review F5 support logs (/var/log/ltm, /var/log/apm) for repeated malformed requests against OAuth-profile-bound virtual servers preceding any instability

Timeline

References

• F5 Article K000162605 — Vendor advisory and mitigation iRule
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance — Forensics Triage Requirements
• NVD — CVE-2026-94127