CVE-2026-94127

Cve • September 22, 2026

When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CWE-122 : Heap-based Buffer Overflow

Default Status: unknown

external site vendor-advisory

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in F5 BIG-IP APM Exploited A heap-based buffer overflow vulnerability (CVE-2026-94127) in F5 BIG-IP Access Policy Manager (APM) allows unauthenticated remote code execution on the Traffic Management Microkernel (TMM) data plane. This flaw is triggered when a virtual server is configured with both an APM access policy and an OAuth profile, making it accessible without authentication. F5 confirmed the vulnerability on September 2, 2026, and active exploitation is currently underway, as reported by the Canadian Centre for Cyber Security. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 22, 2026, mandating remediation within three days for federal agencies. The vulnerability has a CVSS score of 9.8, indicating a high-risk classification. Organizations using affected configurations must inventory their virtual servers and apply available patches or mitigations immediately. The incident is part of a broader cluster of security events in September that have tested trust-based systems. 4 sources 79

Extracted Entities

CVE-2026-94127

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)