{
  "id": 13915065,
  "title": "F5's BIG-IP APM Heap Overflow Puts Remote Code Execution Behind an OAuth Profile",
  "url": "https://urgent.news/2026/10/12/f5s-big-ip-apm-heap-overflow-puts-remote-code-execution-behind-an",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-12T09:00:02.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/echakiri/f5s-big-ip-apm-heap-overflow-puts-remote-code-execution-behind-an-oauth-profile-dal"
  },
  "original_language": "en",
  "account": "F5 announced a critical vulnerability (CVE-2026-94127) affecting its BIG-IP Access Policy Manager (APM) on September 22, 2026. This heap-based buffer overflow in the APM's OAuth Authorization Server component allows unauthenticated attackers to execute arbitrary code on affected systems without requiring any credentials. The vulnerability is present in specific BIG-IP APM versions (21.1.0, 17.5.0-17.5.1, and 17.1.0-17.1.3) when both an APM access policy and an OAuth profile are configured on the same virtual server. The flaw resides in the data plane, meaning no control plane exposure exists, and requests from untrusted networks can trigger the vulnerability. Detection involves repeated OAuth failures, suspicious commands, and a SIGABRT raised by the traffic management microkernel (TMM). F5 recommends applying an engineering hotfix to address the issue while CISA advises forensic triage and urges organizations to prioritize remediation given the nature of the exposure.",
  "summary": "TL;DR BIG-IP APM is the access policy module F5 adds to its BIG-IP platform, the component a company runs at the edge of its network to check who a user is before a request reaches an application. F5 published CVE-2026-94127 on 22 September 2026 and rates it Critical at 9.8 under CVSS v3.1 and 9.3 under v4.0; it is a heap-based buffer overflow that lets an attacker run code with no credentials.…",
  "key_points": [
    "F5 issues critical CVE-2026-94127 affecting BIG-IP APM",
    "Heap overflow in OAuth Authorization Server allows remote code execution",
    "Vulnerable versions include 21.1.0, 17.5.0-17.5.1, and 17.1.0-17.1.3"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}