Skip to main content
Apexward Pulse

F5 · Memory corruption

F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

CVE-2026-94127

What this means

This is rated critical severity (9.3 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether f5 Big Ip Access Policy Manager is in your estate, and treat that as the priority.

Full vendor description

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scoring and exploitation

9.3/ 10
CVSS 4.0 base scoreCritical

Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Attack requirementsNoneAT:N
Privileges requiredNonePR:N
User interactionNoneUI:N

Impact

Longer bar: more harm

ConfidentialityHighVC:H
IntegrityHighVI:H
AvailabilityHighVA:H
Elevated attack likelihood (~26.6% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
F5 BIG-IP APM

Weaknesses

CWE-122

Affected products ()

  • f5 Big Ip Access Policy Manager
Show the raw CPE strings (2)
  • cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_access_policy_manager:21.1.0:*:*:*:*:*:*:*

References

2 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events

  • F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

    Type Vulnerability

    CVE-2026-94127 has an estimated attack likelihood score of 0.249 (~24.9% estimated chance of exploitation in the next 30 days; 97.9th percentile) as of 2026-10-25.

    Next step: Confirm whether F5 BIG-IP Access Policy Manager is in your estate.

    Who's reporting

    1 of 3 perspectives

    Official authority: Official 1Vendor statement missing. no VendorResearcher coverage missing. no Researcher1 signal

    Only official coverage so far. Treat as an early signal.

    F5 BIG-IP Access Policy Manager
    CVE-2026-94127