CVE-2026-94127 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-22

Added to CISA KEV: 2026-09-22 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — IMMEDIATE ACTION: Identify all BIG-IP virtual servers with both an APM access policy AND an OAuth profile configured. These are the exploitable surfaces. Run F5's recommended configuration audit per K000162605.
CRITICAL — PATCH IMMEDIATELY: Apply the relevant hotfix for your branch — Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG — as per F5 advisory K000162605.
CRITICAL — ACTIVE EXPLOITATION: This vulnerability is being actively exploited. Before patching, conduct compromise assessment: review APM access logs for anomalous OAuth token requests, unexpected process spawning, unusual outbound connections from BIG-IP, and any unrecognised administrative sessions.
WORKAROUND: If immediate patching is not possible, contact F5 Support to request the iRule mitigation. Apply it to all affected virtual servers while scheduling the hotfix deployment.
NETWORK CONTROLS: As an interim measure, restrict access to APM+OAuth virtual servers by source IP where business requirements permit. Implement WAF rules upstream to detect malformed OAuth traffic patterns if available.
MONITORING: Enable enhanced logging on BIG-IP APM for OAuth transaction anomalies. Deploy SIEM alerts for unexpected TMSH or bash execution events originating from the data plane. Monitor for lateral movement from the BIG-IP management network.
THREAT HUNTING: Search for indicators of post-exploitation activity — web shells, cron job modifications, unexpected SSH keys, or changes to BIG-IP configuration that were not administratively authorised.
PATCH PRIORITY: P1 / Emergency — treat this as equivalent to a known-exploited critical vulnerability. Patching window should be measured in hours, not days.

🔍 Web Intelligence (Kagi · 2026-09-22)

Summary

CVE-2026-94127 is a critical remote code execution (RCE) vulnerability affecting F5 BIG-IP systems that have both an Access Policy Manager (APM) access policy and an OAuth profile configured on a virtual server. By sending specially crafted malicious traffic to an affected virtual server, an unauthenticated attacker can achieve code execution, posing a severe security risk to organizations relying on BIG-IP for traffic management and security.

Exploitation

Active Exploitation: The vulnerability is confirmed to be actively exploited in the wild ^[1]^[4].
Threat Actors/Campaigns: Specific threat actor groups or ransomware campaigns have not been definitively named in public advisories as of the current date, though active in-the-wild exploitation is documented ^[1].
PoC/Exploit Tool Availability: Public reporting indicates the vulnerability is a CVSS 9.8 issue ^[2]^[3], and exploitation technical details have been discussed, though users should consult F5's official guidance for specific mitigation.
Attack Prerequisites: This is a network-based attack that does not require authentication or user interaction ^[1].

Affected Products & Patches

Affected Product Versions: F5 BIG-IP systems (including those in Appliance mode) utilizing both an APM access policy and an OAuth profile on a virtual server are affected ^[1].
Patch/Hotfix: Users should immediately refer to the official F5 security advisory (K000162605) for the latest available patches or hotfixes applicable to their specific BIG-IP software versions ^[1].
Mitigations: Organizations are advised to audit their configurations to identify exposed data-plane virtual servers (VIPs) using the vulnerable combination of features and apply recommended software updates immediately ^[2].

Impact

Access/Capability: Successful exploitation grants an unauthenticated attacker the ability to execute arbitrary code on the affected BIG-IP system, potentially leading to a full system compromise ^[1].
Business Risk: For internet-facing deployments, this vulnerability presents an extreme risk, as it allows external attackers to bypass authentication entirely to gain control over critical infrastructure, which can result in unauthorized access to backend networks, data exfiltration, or complete service disruption.

Sources

K000162605: BIG-IP APM vulnerability CVE-2026-94127
Security Advisory Description When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious ... Security Advisory Description When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to…
CVE-2026-94127: F5 BIG-IP APM OAuth Unauthenticated RCE — Detection and ...
F5 BIG-IP APM virtual servers with OAuth profiles face CVE-2026-94127, a CVSS 9.8 network unauthenticated RCE. Inventory exposed data-plane VIPs and patch now.
CVE-2026-94127: F5 BIG IP Heap Buffer Overflow | CVETodo
CVE-2026-94127 is a CVSS 9.8 Heap Buffer Overflow vulnerability in F5 BIG IP. See exploitation status, patch guidance, and technical details.
F5 BIG-IP: rilevato sfruttamento in rete della CVE-2026- ...
Rilevato lo sfruttamento in rete di una vulnerabilità, identificata tramite la CVE-2026-94127, presente in BIG-IP APM. Tale vulnerabilità, qualora sfruttata ...

🔴 CVE-2026-94127