F5's BIG-IP APM Heap Overflow Puts Remote Code Execution Behind an OAuth Profile
TL;DR BIG-IP APM is the access policy module F5 adds to its BIG-IP platform, the component a company runs at the edge of its network to check who a user is before a request reaches an application. F5 published CVE-2026-94127 on 22 September 2026 and rates it Critical at 9.8 under CVSS v3.1 and 9.3 under v4.0; it is a heap-based buffer overflow that lets an attacker run code with no credentials.…
F5 announced a critical vulnerability (CVE-2026-94127) affecting its BIG-IP Access Policy Manager (APM) on September 22, 2026. This heap-based buffer overflow in the APM's OAuth Authorization Server component allows unauthenticated attackers to execute arbitrary code on affected systems without requiring any credentials. The vulnerability is present in specific BIG-IP APM versions (21.1.0, 17.5.0-17.5.1, and 17.1.0-17.1.3) when both an APM access policy and an OAuth profile are configured on the same virtual server.
The flaw resides in the data plane, meaning no control plane exposure exists, and requests from untrusted networks can trigger the vulnerability. Detection involves repeated OAuth failures, suspicious commands, and a SIGABRT raised by the traffic management microkernel (TMM). F5 recommends applying an engineering hotfix to address the issue while CISA advises forensic triage and urges organizations to prioritize remediation given the nature of the exposure.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
