Skip to content
Sign in
CVE-2026-941279.8CriticalCWE-122

CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

F5 · BIG-IP

Vendor fix available · Affected: F5 BIG-IP · Exploitation: in CISA KEV since 22 Sep

ExploitationIn CISA KEV

  1. In CISA KEVCISA KEV catalogue22 Sep
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public2 public GitHub repositories (unverified), listed by PoC-in-GitHub23 Sep
  5. Not established: not seen
26.6%probability of exploitation in the next 30 days
98th percentile
050100

Higher than 98% of scored CVEs

9.8CriticalCVSS 3.1
LowCrit.

Federal deadline

CISA KEV · added 22 Sep · catalogue entry

Passed 42 days ago

DescriptionNVD

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

What changed

  1. PoC-in-GitHub lists 2 public GitHub repositories (unverified) PoC-in-GitHub
  2. CISA added it to the KEV catalogue CISA

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage10 articles · 6 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 22 Sep.

Full timeline
Quiet for 6 weekslast report 28 Sep10 articles6 outlets
22 Sep · SecurityOnline first17 Oct25 OctNow
  • Tue 22 Sep, 18:01 UTC. SecurityOnline, first report. F5 Warns Hackers Are Exploiting Critical BIG-IP APM Flaw. Cites a CVE in CISA KEV.
  • Tue 22 Sep, 20:31 UTC. CISA, its first report on the story. CISA Warns of Active Attacks Exploiting Critical F5 BIG-IP Flaw. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 07:36 UTC. SecurityWeek, its first report on the story. F5 BIG-IP APM zero-day lets attackers execute code remotely. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 09:59 UTC. Rapid7, its first report on the story. F5 BIG-IP Flaw Enables Unauthenticated Remote Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 18:14 UTC. Security Affairs, its first report on the story. F5 Patches Exploited BIG-IP Flaw Allowing Unauthenticated Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 21:50 UTC. Security Affairs. CISA Warns of Active Attacks on Check Point and F5 Flaws. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 03:36 UTC. SecurityOnline. Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at Risk. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 03:47 UTC. SecurityOnline. F5 Patches Exploited BIG-IP Zero-Day Enabling Remote Code Execution. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline. Nine Flaws Exploited as Attackers Target Edge Products and WordPress. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. Check Point, its first report on the story. Check Point Warns of Active Exploits and AI-Powered Attacks. Cites a CVE in CISA KEV.
All coveragerunning total10SecurityOnl…4CISA1SecurityWeek1Rapid71Security Af…2Check Point123 Sep9 Oct25 OctNow
  • First report
  • Article
  • Official notice
  • Running total

Added to CISA KEV

Show as table
10 articles about CVE-2026-94127 from 6 outlets
Published (UTC)OutletHeadline
22 Sep 18:01SecurityOnlineF5 Warns Hackers Are Exploiting Critical BIG-IP APM Flaw
22 Sep 20:31CISACISA Warns of Active Attacks Exploiting Critical F5 BIG-IP Flaw
23 Sep 07:36SecurityWeekF5 BIG-IP APM zero-day lets attackers execute code remotely
23 Sep 09:59Rapid7F5 BIG-IP Flaw Enables Unauthenticated Remote Code Execution
23 Sep 18:14Security AffairsF5 Patches Exploited BIG-IP Flaw Allowing Unauthenticated Code Execution
23 Sep 21:50Security AffairsCISA Warns of Active Attacks on Check Point and F5 Flaws
24 Sep 03:36SecurityOnlineCritical Flaws Put VeloCloud, BIG-IP and Rancher Systems at Risk
25 Sep 03:47SecurityOnlineF5 Patches Exploited BIG-IP Zero-Day Enabling Remote Code Execution
28 Sep 02:30SecurityOnlineNine Flaws Exploited as Attackers Target Edge Products and WordPress
28 Sep 14:30Check PointCheck Point Warns of Active Exploits and AI-Powered Attacks
  1. Check Point Warns of Active Exploits and AI-Powered Attacks
    Check Point · mentions it in passing
  2. Nine Flaws Exploited as Attackers Target Edge Products and WordPress
    SecurityOnline · mentions it in passing
  3. F5 Patches Exploited BIG-IP Zero-Day Enabling Remote Code Execution
    SecurityOnline
  4. Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at Risk
    SecurityOnline · mentions it in passing
  5. CISA Warns of Active Attacks on Check Point and F5 Flaws
    Security Affairs · mentions it in passing
  6. F5 Patches Exploited BIG-IP Flaw Allowing Unauthenticated Code Execution
    Security Affairs
  7. F5 BIG-IP Flaw Enables Unauthenticated Remote Code Execution
    Rapid7
  8. F5 BIG-IP APM zero-day lets attackers execute code remotely
    SecurityWeek
Show 2 more

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in