Security2 hOctober 12, 2026, 00:40

F5 BIG-IP APM: critical CVE-2026-94127 heap overflow in OAuth setups

F5 disclosed CVE-2026-94127 on 22 September 2026, a heap-based buffer overflow in BIG-IP APM rated CVSS 9.8 that can lead to remote code execution. Only deployments where APM acts as an OAuth Authorization Server are affected; CISA added the flaw to its Known Exploited Vulnerabilities catalog.

DEV Community

Open source

F5 BIG-IP APM: critical CVE-2026-94127 heap overflow in OAuth setups

CVSS 9.8 (v3.1) and 9.3 (v4.0), CWE-122, F5 internal ID 2524777
Only virtual servers with an APM access policy and OAuth authorization server profile are exposed
Affected branches: 21.1.x, 17.5.x and 17.1.x; engineering hotfixes released
F5 offers an iRule as a temporary mitigation if patching is not possible

#F5#BIG-IP#CISA

F5 patches exploited BIG-IP APM zero-day enabling RCE

Security

ZoomEye Finds 1,577,590 F5 BIG-IP Matches After CVE-2026-94127 KEV Entry

Security

ZoomEye finds 1.58M F5 BIG-IP fingerprint matches, 55,390 on port 443

Security

F5 BIG-IP APM: critical CVE-2026-94127 heap overflow in OAuth setups

F5 patches exploited BIG-IP APM zero-day enabling RCE

ZoomEye Finds 1,577,590 F5 BIG-IP Matches After CVE-2026-94127 KEV Entry

ZoomEye finds 1.58M F5 BIG-IP fingerprint matches, 55,390 on port 443

FreeSWITCH mod_verto heap overflow rated CVSS 9.8