F5 BIG-IP APM CVE-2026-94127: an unauthenticated RCE that a hardening setting does not stop
F5 BIG-IP APM CVE-2026-94127: an unauthenticated RCE that a hardening setting does not stop A load balancer can be an attack surface, not only a traffic cop. CVE-2026-94127 in F5 BIG-IP Access Policy Manager (APM) shows why that distinction matters at the edge of the network. What the vulnerability is F5 published advisory K000162605 for CVE-2026-94127 on 2026-09-22, and CISA added the CVE to its…
CVE-2026-94127 is a critical remote code execution vulnerability in F5 BIG-IP Access Policy Manager (APM). It allows unauthenticated attackers to send specially crafted network traffic and corrupt memory, leading to arbitrary code execution. The flaw affects BIG-IP APM deployments that utilize both an access policy and an OAuth profile, particularly when the OAuth authorization server use case is in place.
Devices using APM only as an OAuth client or resource server are not impacted. BIG-IP Appliance mode is still vulnerable, so the usual hardening measures do not eliminate the risk. F5 released hotfixes for the affected versions, but retrospective log analysis is necessary to confirm if an attacker has already gained access.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
