Vulnerability details

CVE-2026-94127

Actively exploited

F5 BIG-IP

BIG-IP APM OAuth vulnerability

CVSS 4.0

9.3Critical

Official description

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS scores

Score	Version	Source	Vector
9.3Critical	4.0	CVEProject cvelistV5 (CNA) (f5)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
9.8Critical	3.1	CVEProject cvelistV5 (CNA) (f5)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
F5	BIG-IP	17.1.0 ≤ v < Hotfix-BIGIP-17.1.3.5.0.41.14-ENG	CVEProject cvelistV5 (CNA)
F5	BIG-IP	17.5.0 ≤ v < Hotfix-BIGIP-17.5.1.9.0.160.12-ENG	CVEProject cvelistV5 (CNA)
F5	BIG-IP	21.1.0 ≤ v < Hotfix-BIGIP-21.1.0.2.0.30.22-ENG	CVEProject cvelistV5 (CNA)

References and advisories

https://my.f5.com/manage/s/article/K000162605 vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127 government-resource

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-22
Last updated: 2026-09-23
State: Published
Assigner (CNA): f5
Kolun priority: 88 · Critical

CISA KEV catalog

Date added: 2026-09-22
Due date: 2026-09-25
Used in ransomware: Unknown

Exploit prediction (EPSS)

26.55%

Probability of exploitation in 30 days

98%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Active
Technical impact: Total

Weaknesses (CWE)

CWE-122
Heap-based Buffer Overflow