A critical vulnerability in F5 BIG-IP devices is being leveraged by attackers right now. Tracked as CVE-2026-94127, it allows a remote attacker to execute code on the system without needing to authenticate. Because many BIG-IP appliances sit at the network edge, the risk is direct and high.
What it is, exactly
CVE-2026-94127 is a heap-based buffer overflow (CWE-122) in the Access Policy Manager (APM) module of BIG-IP. F5 disclosed it on September 22, 2026 in advisory K000162605 and assigned it a CVSS v3.1 score of 9.8, the critical severity tier.
The flaw is triggered when specially crafted traffic reaches an affected virtual server: that input corrupts the memory of the Traffic Management Microkernel (TMM) and opens the door to arbitrary code execution. In practice, an attacker who can reach the exposed service can take control of the device without credentials and without user interaction.
Are you exposed? The key condition
Here's the nuance many people miss: this is not the default configuration. Simply having BIG-IP APM installed is not enough to be vulnerable. Exposure depends on a specific combination:
- A virtual server with both an APM access policy and an OAuth profile configured at the same time.
- APM operating as an OAuth Authorization Server.
If you use APM only as an OAuth Client or Resource Server, you are not affected through this vector.
An important defensive detail: this is a data plane flaw, not a management plane one. That means restricting access to the administrative interface does not remove the risk, because the attack arrives through the application traffic processed by the virtual server, not through the admin interface. Systems running in Appliance mode can also be vulnerable if the affected configuration is present.
Active exploitation and a public PoC
Two facts raise the urgency:
-
CISA added it to its KEV (Known Exploited Vulnerabilities) catalog on September 22, 2026, which confirms real exploitation, not hypothetical. A remediation deadline for U.S. federal systems was set for September 25, 2026.
-
A public PoC already exists. At the initial advisory there was no confirmed proof of concept, but in the following days watchTowr Labs released a tool that, while presented as a detection artifact generator, functionally demonstrates remote code execution.
The combination of in-the-wild exploitation plus publicly available code drastically shrinks the window you have to act.
What to do now
- Identify the vulnerable configuration. Check whether any virtual server has both an APM access policy and an OAuth profile (as Authorization Server) at the same time. That is the exposure criterion.
- Apply the F5 hotfix. The published update paths are:
- BIG-IP 21.1.0 → Hotfix-BIGIP-21.1.0.2.0.30.22-ENG or later
- BIG-IP 17.5.0 → Hotfix-BIGIP-17.5.1.9.0.160.12-ENG or later
- BIG-IP 17.1.0 → Hotfix-BIGIP-17.1.3.5.0.41.14-ENG or later
- If you can't patch immediately, apply the mitigations described in the official F5 advisory.
- Don't rely on restricting administrative access. Remember: it's data plane. Prioritize cutting off or protecting the exposure of the affected virtual server.
- Hunt for indicators of compromise. With active exploitation, assume prior exposure may have been abused and review the device's logs and behavior.
Conclusion
CVE-2026-94127 checks every box of a patching emergency: critical severity, unauthenticated RCE, confirmed exploitation, a public PoC, and devices typically exposed to the Internet. If your organization runs F5 BIG-IP APM with the described configuration, patching shouldn't wait for the next maintenance window.
Sources: official F5 advisory (K000162605), CISA KEV catalog, and analysis from Rapid7 and SOC Prime.
Official F5 source: Security Advisory K000162605 — F5
Author: (Edu Quijano)