CVE · Exploited · On CISA KEV

CVE-2026-94127

F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

9.3: CVSS 4.0
1: story
SEP 22: added to KEV

Severity: 9.3 Critical · vendor score
Vendor: F5
Product: BIG-IP APM
Published: Sep 22, 2026
Added to KEV: Sep 22, 2026
KEV deadline: Sep 25, 2026
Ransomware use: Unknown
Weakness: CWE-122

What it is

F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

SEP 24
VulnerabilitiesF5 CVE-2026-94127 Targeted in Active AttacksThis vulnerability allows for unauthenticated remote code execution and shows how a missing bounds check—a classic programming error.DENNIS FISHER · 2 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorymy.f5.com/manage/s/article/K000162605