If your BIG-IP virtual server pairs APM with an OAuth profile, you are on a three-day federal clock. CISA added an unauthenticated data-plane RCE to KEV yesterday, with the same Friday due date as the two Check Point bugs. F5 also asks for forensic triage after patching.
What happened
On September 22, 2026, F5 published advisory K000162605 for CVE-2026-94127: a heap-based buffer overflow on the data plane when a virtual server has both an APM access policy and an OAuth profile. Crafted malicious traffic yields unauthenticated remote code execution. Appliance mode does not help. The exposure is the virtual server, not the control plane.
CISA added the CVE to KEV the same day with a federal due date of September 25, 2026 and forensic triage required. Temporary mitigation: request and apply F5’s iRule, then install the engineering hotfixes for your train.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why it matters
APM + OAuth is exactly how many shops front SSO and modern app access. Unauthenticated RCE on that virtual server puts an attacker on the device that brokers those logins. This is not the PoisonedRefresh APM web-shell bug from earlier in September. It has its own CVE, advisory and KEV deadline.
What to do first
- Inventory every BIG-IP VIP with APM access policy and an OAuth profile bound.
- Apply the matching ENG hotfix: 21.1.0.2.0.30.22-ENG, 17.5.1.9.0.160.12-ENG, or 17.1.3.5.0.41.14-ENG.
- If you cannot patch tonight: open an F5 ticket for the interim iRule, and/or unbind OAuth or APM from exposed VIPs where business allows.
- Forensic triage per BOD 26-04 before declaring clean — patch ≠ clean on previously exposed data-plane VIPs.
- Rotate secrets and review APM sessions/policy changes in the pre-patch window.
Details
- CVE: CVE-2026-94127 (CVSS 4.0 base 9.3; heap overflow CWE-122)
- Product: F5 BIG-IP APM (affected trains 21.1 / 17.5 / 17.1 with APM+OAuth on a VIP)
- KEV: Added 2026-09-22; federal due 2026-09-25; forensic triage Yes
- Advisory: https://my.f5.com/manage/s/article/K000162605
- Ransomware use (CISA): Unknown
Hunt / verify
- Confirm installed hotfix build strings match K000162605 for each chassis/vCMP guest.
- List VIPs with both APM and OAuth; anything still unmatched is still exposed.
- Review data-plane logs for anomalous OAuth/APM traffic before the patch window; preserve evidence if compromise is suspected.
Sources
- https://my.f5.com/manage/s/article/K000162605
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://nvd.nist.gov/vuln/detail/CVE-2026-94127
- https://cve.report/CVE-2026-94127
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
