CVE-2026-94127 is a critical remote code execution vulnerability affecting specific configurations of F5 BIG-IP Access Policy Manager, or BIG-IP APM. The vulnerability was publicly disclosed on September 22, 2026, and deserves considerably more attention than a routine high-severity CVE because F5 says attackers are already exploiting it in the wild.
The vulnerability has a CVSS v3.1 score of 9.8 Critical and is classified as CWE-122, Heap-based Buffer Overflow. Under the affected configuration, specially crafted network traffic can reach the vulnerable APM processing path and allow an unauthenticated remote attacker to execute code on the BIG-IP system. CERT-EU confirmed these core details in its September 22 security advisory and urged organizations to take action as soon as possible. (CERT-EU)
The primary source is F5’s security advisory K000162605: BIG-IP APM vulnerability CVE-2026-94127. Because F5’s support portal may require an account or redirect some visitors through its customer login system, government advisories from CERT-EU, CERT-FR and the Canadian Centre for Cyber Security provide useful independent confirmation of the vendor’s findings.
F5 Security Advisory K000162605
CERT-EU Security Advisory 2026-013
Canadian Centre for Cyber Security AL26-022
The vulnerability is especially important for security teams responsible for load balancers, identity infrastructure, authentication gateways, or internet-facing application delivery platforms. BIG-IP systems often sit directly between untrusted networks and sensitive internal applications. Remote code execution at that layer can therefore have consequences that extend well beyond the appliance itself.
But there is an equally important qualification: not every BIG-IP APM deployment is vulnerable to CVE-2026-94127.
Understanding exactly which configuration activates the vulnerable code path is the first step toward assessing real exposure.
What Is CVE-2026-94127?
CVE-2026-94127 is a heap-based buffer overflow vulnerability in F5 BIG-IP APM.
According to the F5 vulnerability description reproduced by government cybersecurity authorities, the vulnerability exists when an APM access policy and an OAuth profile are configured on the same virtual server. Under these conditions, specially crafted malicious traffic can lead to remote code execution.
The Canadian Centre for Cyber Security describes the issue as a heap-based buffer overflow affecting F5 BIG-IP systems with precisely this combination of APM and OAuth configuration. Successful exploitation may allow an unauthenticated attacker to execute arbitrary code on the affected device and potentially achieve full system compromise. (Canadian Centre for Cyber Security)
The vulnerability’s CVSS v3.1 vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HThat vector helps explain why CVE-2026-94127 received a 9.8 rating.
AV:N means exploitation can occur over the network.
AC:L means attack complexity is considered low.
PR:N means the attacker does not need existing privileges.
UI:N means exploitation does not require interaction from a legitimate user.
The confidentiality, integrity, and availability impacts are all rated High.
In practical terms, this is the combination defenders least want to see on an enterprise edge appliance: network-accessible, unauthenticated remote code execution with no user interaction required.
CVE-2026-94127 Only Affects Specific OAuth Configurations
This is probably the most important technical distinction in the entire CVE.
Running BIG-IP APM is not enough by itself to make a device vulnerable.
F5 states that the vulnerable condition is present when BIG-IP APM is configured as an OAuth Authorization Server. Systems using APM strictly as an OAuth Client or OAuth Resource Server, without an OAuth Authorization Server profile, are not affected by this vulnerability.
NHS England’s cybersecurity alert, based directly on the F5 advisory, explicitly highlights this distinction: the vulnerability is only present when BIG-IP APM operates as an OAuth Authorization Server. (NHS England Digital)
The relevant architecture can be simplified as:
Internet
|
v
+----------------+
| BIG-IP Virtual |
| Server |
+--------+-------+
|
+---------+---------+
| |
v v
APM Access Policy OAuth Profile
| |
+---------+---------+
|
v
OAuth Authorization Server
|
v
Vulnerable Processing
|
v
Heap Memory Corruption
|
v
Remote Code Execution
This matters enormously for vulnerability management.
A conventional scanner might discover an affected BIG-IP software release and immediately report CVE-2026-94127. But version detection alone does not prove that the vulnerable attack surface is exposed.
Security teams need configuration context.
They need to determine whether the target actually combines the affected BIG-IP version, APM functionality, the relevant access policy, an OAuth profile, and the OAuth Authorization Server role.
That is a much more meaningful measure of exploitability than a simple version match.
CVE-2026-94127 Affected Versions
The Canadian Centre for Cyber Security lists the following affected BIG-IP APM branches and corresponding F5 engineering hotfixes. (Canadian Centre for Cyber Security)
| BIG-IP APM branch | Affected range | F5 fixed hotfix |
|---|---|---|
| 17.1.x | 17.1.0 before the relevant fixed hotfix | Hotfix-BIGIP-17.1.3.5.0.41.14-ENG |
| 17.5.x | 17.5.0 before the relevant fixed hotfix | Hotfix-BIGIP-17.5.1.9.0.160.12-ENG |
| 21.1.x | 21.1.0 before the relevant fixed hotfix | Hotfix-BIGIP-21.1.0.2.0.30.22-ENG |
CERT-EU similarly identifies affected BIG-IP APM releases in the 17.1, 17.5, and 21.1 branches. (CERT-EU)
Administrators should verify the exact supported remediation against F5’s current advisory before deploying an update, particularly because F5 can revise hotfix or release guidance after initial disclosure.
F5 official CVE-2026-94127 remediation guidance
There is another caveat that should not be overlooked.
F5 states that software versions that have reached End of Technical Support, or EoTS, were not evaluated.
That does not mean unsupported BIG-IP releases are safe.
It means F5 did not evaluate them as part of this advisory.
Security teams running obsolete BIG-IP versions should therefore not interpret the absence of an old release from the affected-version table as evidence that the underlying code is unaffected.
CVE-2026-94127 Is Being Actively Exploited
The most important risk signal associated with CVE-2026-94127 is not its CVSS score.
It is confirmed exploitation.
F5 reported that attackers are exploiting CVE-2026-94127 in the wild. CERT-EU repeated that warning in its September 22 advisory, while Canada’s Cyber Centre independently published an alert stating that F5 had indicated active exploitation. (CERT-EU)
CERT-FR followed with its own advisory on September 23 and again noted that F5 reported active exploitation and had released indicators of compromise. (CERT-FR)
CERT-FR advisory for CVE-2026-94127
This changes the appropriate defensive response.
For a theoretical vulnerability with no exploitation evidence, a security team might identify affected systems, test patches in staging, schedule maintenance, and deploy the update according to normal emergency patch-management procedures.
CVE-2026-94127 requires another question:
Was this system already compromised before we patched it?
That means patching and compromise assessment should happen as parallel parts of the response.
CISA Added CVE-2026-94127 to the KEV Catalog
CVE-2026-94127 was added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on September 22, 2026, the same date as its public disclosure.
The Canadian Centre for Cyber Security subsequently updated its advisory to explicitly note the CISA KEV inclusion. (Canadian Centre for Cyber Security)
The CISA KEV catalog is particularly valuable because it does not simply identify vulnerabilities that could theoretically be exploited. It tracks vulnerabilities for which there is evidence of exploitation in real environments.
CISA Known Exploited Vulnerabilities entry for CVE-2026-94127
CISA’s inclusion of CVE-2026-94127 therefore reinforces the same conclusion already provided by F5 and multiple government CERTs: this is an active exploitation problem rather than a hypothetical one.
Why the Heap-Based Buffer Overflow Matters
CVE-2026-94127 is classified as:
CWE-122: Heap-based Buffer Overflow
Heap memory is used by applications to dynamically allocate data while processes are running.
A simplified example might look like this:
char *buffer = malloc(64);
/* Simplified illustration only */
copy_data(buffer, attacker_controlled_input);If the application allocates 64 bytes but copies more than 64 bytes without properly enforcing the destination size, memory adjacent to that allocation may be corrupted.
In real software, exploitation is far more complicated.
Attackers need to understand how the target process organizes memory, what objects are stored near the affected allocation, which memory protections are enabled, how predictable the allocator is, and whether corrupted memory can ultimately influence execution flow.
For this reason, the existence of a buffer overflow does not automatically imply trivial code execution.
In CVE-2026-94127, however, F5 itself has classified the eventual security impact as unauthenticated RCE, and active exploitation has already been confirmed. That removes much of the uncertainty normally associated with evaluating whether a memory-corruption flaw is practically exploitable. (Canadian Centre for Cyber Security)
This Is a Data-Plane Vulnerability
Another important aspect of CVE-2026-94127 is where the attack occurs.
F5 describes the vulnerability as a data-plane issue rather than a control-plane issue. NHS England’s advisory reproduces F5’s statement that there is “no control plane exposure.” (NHS England Digital)
That distinction can easily be misunderstood.
C'est le cas pas mean the vulnerability is harmless because the BIG-IP management interface is inaccessible from the internet.
The vulnerable path is associated with application traffic being processed through the affected virtual server.
A typical deployment might resemble:
External Users / Internet
|
v
+-------------------+
| F5 BIG-IP |
| |
| Virtual Server |
| APM |
| OAuth Server |
+---------+---------+
|
v
Internal Applications
/ \
v v
Web App API
|
v
Identity Systems
An organization may have done everything correctly regarding management-plane exposure—restricting SSH, the web administration interface and administrative network access—while still exposing the vulnerable data-plane functionality because doing so is necessary for the application to operate.
That is why checking whether the management interface is public is insufficient for evaluating CVE-2026-94127.
Appliance Mode Does Not Protect BIG-IP Against CVE-2026-94127
F5 also specifically notes that BIG-IP Appliance mode remains vulnerable.
Appliance mode restricts certain administrative capabilities and is often used to harden BIG-IP installations. However, those restrictions do not eliminate the vulnerable APM code path involved in CVE-2026-94127.
Administrators should therefore not use the presence of Appliance mode as a reason to downgrade remediation priority.
The affected service configuration is what matters.
Why BIG-IP Vulnerabilities Are High-Value Targets
The architectural position of BIG-IP makes vulnerabilities such as CVE-2026-94127 particularly important.
BIG-IP appliances can perform load balancing, TLS termination, application routing, access enforcement, authentication integration, reverse proxying and application delivery.
They often occupy a position similar to:
Internet
|
v
Firewall
|
v
F5 BIG-IP
|
+------------+
| |
v v
Application APIs
Servers
|
v
Internal ServicesCompromising this infrastructure is fundamentally different from compromising an isolated workstation.
The edge appliance has visibility into and connectivity with traffic flows that an external attacker would normally never be able to access directly.
That does not mean exploitation of CVE-2026-94127 automatically leads to compromise of every downstream system. The actual post-exploitation possibilities depend on segmentation, system privileges, credentials, BIG-IP configuration and other environmental factors.
But it explains why unauthenticated RCE vulnerabilities affecting application-delivery and identity infrastructure receive such aggressive attention from attackers.
How to Determine Whether You Are Vulnerable to CVE-2026-94127
A useful assessment should not stop at software version detection.
Start with the software branch.
Is BIG-IP running an affected version?
|
+-----+-----+
| |
No Yes
| |
Not affected v
Is APM enabled?
|
+----+----+
| |
No Yes
| |
Not affected v
APM access policy
on virtual server?
|
+----+----+
| |
No Yes
| |
Not affected v
OAuth profile present?
|
+----+----+
| |
No Yes
| |
Not affected v
OAuth Authorization
Server?
|
+----+----+
| |
No Yes
| |
Not affected HIGH
PRIORITYThe Canadian Cyber Centre specifically recommends identifying BIG-IP systems that contain both an APM access policy and an OAuth profile on a virtual server. (Canadian Centre for Cyber Security)
The additional OAuth role distinction is equally important. OAuth Client and Resource Server configurations without the Authorization Server profile are excluded from the vulnerable configuration described by F5. (NHS England Digital)
This is a good example of why vulnerability validation increasingly requires more than CVE-to-version matching.
CVE-2026-94127 Detection and Indicators of Compromise
Because exploitation has already occurred in the wild, security teams should investigate vulnerable systems for evidence of earlier attacks.
The Canadian Centre for Cyber Security recommends reviewing access logs for indicators of compromise, with particular attention to OAuth authentication failures occurring rapidly or in unusually large volumes. Administrators should also inspect administrative accounts and access policies for suspicious activity. (Canadian Centre for Cyber Security)
CERT-EU provides additional defensive guidance. It recommends preserving forensic evidence and inspecting BIG-IP APM telemetry as part of the investigation. (CERT-EU)
The important point is not to treat any single failed OAuth request as evidence of exploitation.
Authentication systems routinely generate errors.
Instead, defenders should look for correlated anomalies:
Unusual OAuth traffic
|
v
Repeated authentication failures
|
v
Unexpected service instability
|
v
Suspicious administrative activity
|
v
Configuration changes
|
v
Potential compromiseThe stronger the temporal relationship between those events, the more attention the system deserves.
A high volume of unusual OAuth failures immediately followed by process instability, unexpected administrative changes or suspicious commands is much more meaningful than any one of those signals appearing by itself.
Preserve Forensic Evidence Before Remediation
CERT-EU’s recommendation to preserve forensic evidence before patching is especially important. (CERT-EU)
Patching closes the known vulnerability.
It does not prove that the attacker never exploited it.
If an attacker obtained code execution before remediation and established persistence through another mechanism, installing the hotfix alone may leave the organization compromised.
A sensible incident-response workflow is therefore:
Identify exposed systems
|
v
Capture relevant evidence
|
v
Contain exposure
|
v
Install F5 remediation
|
v
Review historical telemetry
|
v
Search for persistence
|
v
Validate clean stateEvidence preservation can include relevant APM logs, audit logs, configuration state, process information, crash data, administrative changes and network telemetry.
The exact collection procedure should follow the organization’s incident-response requirements and F5’s current guidance.
How to Fix CVE-2026-94127
The preferred remediation is to install F5’s fixed software or engineering hotfix.
The currently documented fixed hotfixes are:
17.1.x:
Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
17.5.x:
Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
21.1.x:
Hotfix-BIGIP-21.1.0.2.0.30.22-ENGThese fixed versions are independently documented by the Canadian Centre for Cyber Security. (Canadian Centre for Cyber Security)
Administrators should nevertheless use the F5 advisory itself as the final authority before performing production upgrades:
F5 K000162605 security advisory
For organizations unable to patch immediately, F5 has also made an iRule mitigation available through F5 Support. Canada’s Cyber Centre specifically recommends contacting F5 Support to obtain the vendor-provided iRule. (Canadian Centre for Cyber Security)
Security teams should obtain that mitigation directly from F5 rather than copying an unofficial version from a blog, GitHub repository or social-media post.
An authentication gateway is the wrong place to deploy an improvised mitigation rule.
Should You Disable the OAuth Authorization Server?
If a virtual server does not actually need BIG-IP APM to function as an OAuth Authorization Server, removing unnecessary functionality can reduce exposure.
But this is not something administrators should do blindly.
OAuth Authorization Server functionality may participate directly in application authentication and authorization workflows. Removing the associated profile without understanding dependencies can create an outage.
The better process is to establish whether the functionality is necessary, identify dependent applications and then either patch immediately or make a controlled configuration change.
Configuration reduction is useful hardening.
It is not a substitute for applying the vendor’s security update on an affected system.
Is There a Public CVE-2026-94127 Exploit?
Confirmed exploitation and public proof-of-concept availability are two different things.
For CVE-2026-94127, there is strong evidence for the first: F5 has confirmed exploitation in the wild, multiple government CERTs have repeated that assessment, and CISA has placed the vulnerability in KEV. (Canadian Centre for Cyber Security)
That does not mean every GitHub repository containing the string CVE-2026-94127 should be treated as a functional RCE exploit.
This distinction matters because automated CVE aggregators often classify repositories based heavily on names, descriptions or CVE references. A scanner or defensive configuration checker can therefore appear in an “exploit” feed without containing a weaponized exploit.
For defenders, however, that distinction should not change remediation priority.
A publicly downloadable exploit is not required when adversaries are already exploiting the vulnerability privately.
CVE-2026-94127 Shows Why CVSS Alone Is Not Enough
Consider two vulnerabilities with a CVSS score of 9.8.
One affects software that is normally disabled, sits behind several layers of network access control and has no known exploitation.
The other affects an internet-facing authentication gateway, requires no credentials and is already being exploited.
The numerical score may be identical.
The operational risk is not.
CVE-2026-94127 combines several high-priority characteristics:
| Risk factor | CVE-2026-94127 |
|---|---|
| Remote attack vector | Oui |
| Authentication required | Non |
| User interaction | Non |
| RCE impact | Oui |
| Edge infrastructure | Oui |
| Active exploitation | Confirmé |
| CISA KEV | Oui |
| Configuration-dependent | Oui |
| Vendor fix available | Oui |
That is why defenders should combine CVSS with exploitation evidence, internet exposure, asset criticality and configuration context.
Scanner Detection Is Not the Same as Exploitability Validation
CVE-2026-94127 also illustrates a broader weakness in conventional vulnerability scanners.
Suppose a scanner identifies:
BIG-IP Version: 17.5.x
CVE-2026-94127: Vulnerable
Severity: CriticalThat result is useful.
But it does not answer the entire security question.
An accurate assessment needs to determine:
Affected BIG-IP version
+
APM provisioned
+
APM access policy
+
OAuth profile
+
Authorization Server role
+
Reachable virtual server
=
Meaningful exposureThis difference between potential vulnerability et validated attack surface becomes increasingly important when security teams manage thousands of systems.
A CVE inventory tells you where to look.
Configuration and exposure validation tell you where the actual attack path exists.
What Defenders Should Do Now
Organizations operating F5 BIG-IP should first identify systems running the affected 17.1, 17.5 and 21.1 branches.
For those systems, determine whether BIG-IP APM is enabled and inspect the relevant virtual-server configuration. Pay particular attention to virtual servers containing both an APM access policy and OAuth profile, then determine whether APM is operating as an OAuth Authorization Server.
If that vulnerable configuration is present, determine whether attacker-controlled traffic can reach the virtual server.
Because active exploitation has already been confirmed, exposed devices should not simply enter a routine patch queue. Preserve relevant evidence, review historical telemetry for suspicious OAuth activity and administrative changes, and deploy the F5-supported hotfix or official interim iRule.
Systems showing credible evidence of suspicious activity should be handled as potential security incidents rather than closed as ordinary vulnerability-management tickets.
Frequently Asked Questions
What is CVE-2026-94127?
CVE-2026-94127 is a critical heap-based buffer overflow affecting specific F5 BIG-IP APM OAuth Authorization Server configurations. Specially crafted network traffic can allow unauthenticated remote code execution. (Canadian Centre for Cyber Security)
What is the CVSS score of CVE-2026-94127?
The vulnerability has a CVSS v3.1 score of 9.8 Critical. CERT-EU’s advisory confirms the 9.8 severity rating. (CERT-EU)
What CWE is CVE-2026-94127?
CVE-2026-94127 is classified as CWE-122: Heap-based Buffer Overflow. (Canadian Centre for Cyber Security)
Is CVE-2026-94127 being exploited in the wild?
Yes. F5 has reported active exploitation, and that assessment has been repeated by CERT-EU, CERT-FR, the Canadian Centre for Cyber Security and other government cybersecurity organizations. (CERT-EU)
Is CVE-2026-94127 in the CISA KEV catalog?
Yes. CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog on September 22, 2026. (Canadian Centre for Cyber Security)
CISA KEV search for CVE-2026-94127
Does every F5 BIG-IP APM server have CVE-2026-94127?
No.
The vulnerability is configuration-dependent. The affected setup involves an APM access policy and OAuth profile on the same virtual server, with APM functioning as an OAuth Authorization Server. Systems used strictly as OAuth Clients or Resource Servers without the Authorization Server profile are not affected by this vulnerability. (NHS England Digital)
Is BIG-IP Appliance mode vulnerable?
Yes. F5’s vulnerability description states that BIG-IP systems operating in Appliance mode remain vulnerable. (NHS England Digital)
Is CVE-2026-94127 a management interface vulnerability?
No. F5 describes this as a data-plane vulnerability with no control-plane exposure. The relevant risk comes from traffic processed through the affected virtual server rather than requiring direct access to the BIG-IP administrative interface. (NHS England Digital)
Is a patch available?
Yes. F5 has released engineering hotfixes for the affected 17.1, 17.5 and 21.1 branches. An iRule mitigation is also available through F5 Support for organizations that cannot immediately apply the hotfix. (Canadian Centre for Cyber Security)
Final Analysis
CVE-2026-94127 is not significant simply because it carries a 9.8 CVSS score.
Its real importance comes from the combination of unauthenticated remote code execution, enterprise edge infrastructure, OAuth-related attack surface and confirmed exploitation in the wild.
At the same time, defenders should avoid the opposite mistake of assuming that every BIG-IP APM installation is exploitable. The vulnerable code path depends on a specific configuration in which APM is used as an OAuth Authorization Server.
That makes accurate asset and configuration discovery extremely valuable.
For organizations that do expose the affected configuration, remediation should be treated as both a vulnerability-management and incident-response problem. Identify the affected virtual servers, preserve relevant forensic evidence, investigate historical OAuth and administrative activity, deploy the official F5 fix, and validate the environment after remediation.
The most authoritative references for ongoing updates are the F5 vendor advisory, CISA KEV catalog, CERT-EU, CERT-FRet le Canadian Centre for Cyber Security. Because CVE-2026-94127 is only days old and actively exploited, those sources should take precedence over static third-party CVE aggregators as new technical details emerge. (CERT-EU)
F5 — K000162605: BIG-IP APM vulnerability CVE-2026-94127
CISA — Known Exploited Vulnerabilities Catalog
CERT-EU — Critical Vulnerability in F5 BIG-IP APM
French 
English 
German 
Spanish 
Portuguese 
Japanese 
Korean 
Hindi 
Arabic 
Turkish 
Hebrew