CVE Details

CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
Published: 2026-09-22 CVSS: 9.8 CRITICAL Product: F5 BIG-IP APM Due Date: 2026-09-25

F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.

No GitHub PoC data.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

No EPSS data.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 9.8
  • Severity: CRITICAL
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

  • Exploitation: active
  • Automatable: yes
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-94127
cveMetadata > assignerOrgId 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName f5
cveMetadata > dateReserved 2026-09-20T17:39:19.975Z
cveMetadata > datePublished 2026-09-22T14:17:42.730Z
cveMetadata > dateUpdated 2026-09-22T14:17:42.730Z
containers > cna > affected > 0 > defaultStatus unknown
containers > cna > affected > 0 > modules > 0 APM
containers > cna > affected > 0 > product BIG-IP
containers > cna > affected > 0 > vendor F5
containers > cna > affected > 0 > versions > 0 > lessThan Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > version 21.1.0
containers > cna > affected > 0 > versions > 0 > versionType custom
containers > cna > affected > 0 > versions > 1 > lessThan Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 1 > version 17.5.0
containers > cna > affected > 0 > versions > 1 > versionType custom
containers > cna > affected > 0 > versions > 2 > lessThan Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
containers > cna > affected > 0 > versions > 2 > status affected
containers > cna > affected > 0 > versions > 2 > version 17.1.0
containers > cna > affected > 0 > versions > 2 > versionType custom
containers > cna > credits > 0 > lang en
containers > cna > credits > 0 > type finder
containers > cna > credits > 0 > value F5
containers > cna > datePublic 2026-09-22T14:00:00.000Z
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > supportingMedia > 0 > base64 False
containers > cna > descriptions > 0 > supportingMedia > 0 > type text/html
containers > cna > descriptions > 0 > supportingMedia > 0 > value <span style="background-color: rgb(255, 255, 255);">When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).</span><br><br>Impact:<br><span style="background-color: rgb(255, 255, 255);">This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.</span><br><br> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
containers > cna > descriptions > 0 > value When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
containers > cna > impacts > 0 > capecId CAPEC-100
containers > cna > impacts > 0 > descriptions > 0 > lang en
containers > cna > impacts > 0 > descriptions > 0 > value CAPEC-100 Overflow Buffers
containers > cna > metrics > 0 > cvssV3_1 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV3_1 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > availabilityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > baseScore 9.8
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity CRITICAL
containers > cna > metrics > 0 > cvssV3_1 > confidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > integrityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV3_1 > scope UNCHANGED
containers > cna > metrics > 0 > cvssV3_1 > userInteraction NONE
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > metrics > 1 > cvssV4_0 > Automatable NOT_DEFINED
containers > cna > metrics > 1 > cvssV4_0 > Recovery NOT_DEFINED
containers > cna > metrics > 1 > cvssV4_0 > Safety NOT_DEFINED
containers > cna > metrics > 1 > cvssV4_0 > attackComplexity LOW
containers > cna > metrics > 1 > cvssV4_0 > attackRequirements NONE
containers > cna > metrics > 1 > cvssV4_0 > attackVector NETWORK
containers > cna > metrics > 1 > cvssV4_0 > baseScore 9.3
containers > cna > metrics > 1 > cvssV4_0 > baseSeverity CRITICAL
containers > cna > metrics > 1 > cvssV4_0 > privilegesRequired NONE
containers > cna > metrics > 1 > cvssV4_0 > providerUrgency NOT_DEFINED
containers > cna > metrics > 1 > cvssV4_0 > subAvailabilityImpact NONE
containers > cna > metrics > 1 > cvssV4_0 > subConfidentialityImpact NONE
containers > cna > metrics > 1 > cvssV4_0 > subIntegrityImpact NONE
containers > cna > metrics > 1 > cvssV4_0 > userInteraction NONE
containers > cna > metrics > 1 > cvssV4_0 > valueDensity NOT_DEFINED
containers > cna > metrics > 1 > cvssV4_0 > vectorString CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
containers > cna > metrics > 1 > cvssV4_0 > version 4.0
containers > cna > metrics > 1 > cvssV4_0 > vulnAvailabilityImpact HIGH
containers > cna > metrics > 1 > cvssV4_0 > vulnConfidentialityImpact HIGH
containers > cna > metrics > 1 > cvssV4_0 > vulnIntegrityImpact HIGH
containers > cna > metrics > 1 > cvssV4_0 > vulnerabilityResponseEffort NOT_DEFINED
containers > cna > metrics > 1 > format CVSS
containers > cna > metrics > 1 > scenarios > 0 > lang en
containers > cna > metrics > 1 > scenarios > 0 > value GENERAL
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-122
containers > cna > problemTypes > 0 > descriptions > 0 > description CWE-122 Heap-based Buffer Overflow
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > providerMetadata > orgId 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab
containers > cna > providerMetadata > shortName f5
containers > cna > providerMetadata > dateUpdated 2026-09-22T14:17:42.730Z
containers > cna > references > 0 > tags > 0 vendor-advisory
containers > cna > references > 0 > url https://my.f5.com/manage/s/article/K000162605
containers > cna > source > discovery INTERNAL
containers > cna > title BIG-IP APM OAuth vulnerability
containers > cna > workarounds > 0 > lang en
containers > cna > workarounds > 0 > supportingMedia > 0 > base64 False
containers > cna > workarounds > 0 > supportingMedia > 0 > type text/html
containers > cna > workarounds > 0 > supportingMedia > 0 > value An iRule is available upon request.<br>Open a ticket with F5 support to request this.
containers > cna > workarounds > 0 > value An iRule is available upon request. Open a ticket with F5 support to request this.
containers > cna > x_generator > engine F5 SIRTBot v1.0