Security Bulletin: Heap-Based Buffer Overflow in F5 BIG-IP Access Policy Manager OAuth Authorization Server

Written by RedLegg's Cyber Threat Intelligence Team | 9/23/26, 7:29 PM

About:

CVE-2026-94127 is a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM) when configured to act as an OAuth Authorization Server.

When a BIG-IP APM access policy and OAuth profile are configured on an affected virtual server, specially crafted malicious traffic can trigger the vulnerability and allow an unauthenticated attacker to execute arbitrary code.

F5 has confirmed active exploitation, and CISA has added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) Catalog. F5 has released engineering hotfixes for affected BIG-IP APM branches and provides a temporary mitigation for organizations unable to patch immediately.

RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.

VULNERABILITIES

Heap-Based Buffer Overflow in F5 BIG-IP Access Policy Manager OAuth Authorization Server

Identifier: CVE-2026-94127
PoC or Exploitation: Confirmed actively exploited. F5 states directly that it has learned this vulnerability has been exploited. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog.
CVSS Score: 9.8 (Critical, CVSS v3.1)

Update / Patch:

F5 has released engineering hotfixes addressing this vulnerability. A temporary mitigation is also available.

Affected versions include:

BIG-IP APM 21.x branch, version 21.1.0

BIG-IP APM 17.x branch, versions 17.5.0 through 17.5.1 and 17.1.0 through 17.1.3

Fixed versions include:

BIG-IP APM 21.x: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso

BIG-IP APM 17.5.x: Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso

BIG-IP APM 17.1.x: Hotfix-BIGIP-17.1.3.5.0.41.14-ENG.iso

If immediate patching is not possible, contact F5 Support to obtain a temporary mitigation iRule for the affected BIG-IP APM virtual server.

F5 Security Advisory K000162605:

https://my.f5.com/manage/s/article/K000162605

Description:

CVE-2026-94127 is a heap-based buffer overflow vulnerability in F5 BIG-IP Access Policy Manager.

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server with APM specifically acting as an OAuth Authorization Server, specific malicious traffic can lead to remote code execution. This allows an unauthenticated attacker to execute arbitrary code.

Mitigation Recommendation:

Apply the applicable engineering hotfix for your BIG-IP APM branch immediately.

Review affected systems for F5's published indicators of compromise.

Check /var/log/apm for repeated authentication failure log entries referencing invalid_token errors, particularly ten or more occurrences from a single IP address in one log.

Run tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed and investigate any unexplained increase in total_failed.

Cross-reference /var/log/audit around the timestamps of any identified OAuth failure spikes and investigate the presence of any TMM core files.

View full post