F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
CVSS 9.8 F5 BIG-IP APM heap overflow: unauth RCE when an access policy and OAuth profile share a virtual server. Confirmed exploited; patches available.
- Vendor
- F5
- Product
- BIG-IP APM
- CVSS
- 9.8
- EPSS (exploit probability)
- 26.6%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-94127 being exploited?
Yes. CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list and CIRCL's KEV catalog.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 26.6% (scored October 31, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ LISTED ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-94127 timeline
- Added to CISA KEVsame day as NVD
- Added to EU KEV (ENISA)same day as NVD
- Published to NVD
- First 0dayNews coverage+1d
- Added to CIRCL KEV+1d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
F5 BIG-IP APM contains a heap-based buffer overflow in the application access module. The vulnerability activates when both an access policy and an OAuth profile are configured on the same virtual server. An unauthenticated remote attacker can trigger the overflow and achieve code execution on the host.
Severity: CVSS 9.8 (Critical) per NVD.
KEV status: CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities catalog on September 22, 2026, confirming active exploitation in the wild. Federal agencies under BOD 26-04 must remediate by September 25, 2026.
Patch: F5 released patches on September 23, 2026. See the F5 advisory for affected versions and patch guidance. CISA also recommends applying the vendor-provided iRule as a temporary mitigation for environments that cannot patch immediately.
For full coverage see F5 Patches BIG-IP APM RCE Zero-Day Under Attack.
Other F5 CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-97205 NGINX HTTP/3 use-after-free in ngx_http_v3_modulewrite-up | [ HIGH ] | 8.1 | 0.8% | — |
| CVE-2026-93479 NGINX map directive use-after-free and buffer overflowwrite-up | [ HIGH ] | 8.1 | 1.2% | — |
| CVE-2026-15176 NGINX HTTP/3 heap buffer overflow in ngx_http_v3_modulewrite-up | [ HIGH ] | 8.1 | 1.0% | — |
| CVE-2026-42533 nginx map directive regex-capture heap buffer overflow in workerwrite-up | [ HIGH ] | 8.1 | 6.3% | — |
| CVE-2025-53521 F5 BIG-IP Stack-Based Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 2.3% | |
| CVE-2023-46748 F5 BIG-IP Configuration Utility SQL Injection Vulnerability | [ HIGH ] | 8.8 | 4.3% | |
| CVE-2023-46747 F5 BIG-IP Configuration Utility Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 96.7% | |
| CVE-2022-1388 F5 BIG-IP iControl REST Authentication Bypassransomware usewrite-up | [ CRITICAL ] | 9.8 | 100.0% |
