F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
CVSS 9.8 F5 BIG-IP APM heap overflow: unauth RCE when an access policy and OAuth profile share a virtual server. Confirmed exploited; patches available.
- Vendor
- F5
- Product
- BIG-IP APM
- CVSS
- 9.8
- EPSS (exploit probability)
- 2.2%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
F5 BIG-IP APM contains a heap-based buffer overflow in the application access module. The vulnerability activates when both an access policy and an OAuth profile are configured on the same virtual server. An unauthenticated remote attacker can trigger the overflow and achieve code execution on the host.
Severity: CVSS 9.8 (Critical) per NVD.
KEV status: CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities catalog on September 22, 2026, confirming active exploitation in the wild. Federal agencies under BOD 26-04 must remediate by September 25, 2026.
Patch: F5 released patches on September 23, 2026. See the F5 advisory for affected versions and patch guidance. CISA also recommends applying the vendor-provided iRule as a temporary mitigation for environments that cannot patch immediately.
For full coverage see F5 Patches BIG-IP APM RCE Zero-Day Under Attack.
