CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

Overview

CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM). Public reporting describes the issue as present when an access policy and an OAuth profile are both configured on a virtual server. An unauthenticated attacker could abuse the flaw to achieve remote code execution on a vulnerable system.

BIG-IP APM often sits at the edge of enterprise networks for remote access and identity-related traffic. A remotely reachable RCE condition in that role is high priority for inventory, patching, and monitoring. Confirm exact product lines, fixed builds, and configuration prerequisites only against the vendor advisory and your own deployment records.

How it works

The weakness is classified as CWE-122 (heap-based buffer overflow). In this class of flaw, software writes more data into a heap buffer than that buffer can hold. Corrupting adjacent heap metadata or objects can let an attacker influence control flow or memory contents, which in severe cases escalates to arbitrary code execution in the vulnerable process.

According to the CISA summary, the condition arises in F5 BIG-IP APM when an access policy and an OAuth profile are configured on a virtual server. An unauthenticated remote party who can reach the affected service path may be able to trigger the overflow and attempt remote code execution. Do not assume packet formats, request fields, or exploit reliability from public summaries alone; treat those details as vendor- and lab-confirmed only.

Heap overflows do not always yield stable RCE in every build or configuration, but defenders should plan as if successful exploitation is possible until the system is patched or the risky configuration is removed.

Am I affected? How to find it in your systems

F5 BIG-IP APM is commonly deployed as an appliance or virtual appliance for SSL VPN, application access, and related identity/proxy functions. Look for BIG-IP instances that run APM and expose virtual servers to users or the internet.

• Inventory: List all BIG-IP devices (hardware, VE, cloud images) and note which have APM licensed and provisioned. Map virtual servers that terminate or handle access policy and OAuth-related traffic.
• Configuration check: Identify virtual servers where both an access policy and an OAuth profile are configured—the combination called out in the public summary. Document management plane vs. data plane exposure and which listeners are internet-facing.
• Version and advisory match: Record running software versions and compare them to the fixed releases and any workarounds in the F5 advisory for CVE-2026-94127. Do not rely on third-party version lists if they conflict with the vendor.
• Telemetry: Watch for unusual crashes or restarts of APM-related processes, unexpected core dumps, anomalous traffic to APM/OAuth endpoints from untrusted sources, and post-auth or post-compromise indicators on the host (new processes, unexpected outbound connections, configuration tampering). Specific exploit signatures may not be public; prioritize vendor and CISA guidance for detection content.

If you use managed or cloud-delivered F5 services, confirm shared-responsibility boundaries and whether the provider has applied platform fixes.

How to remediate

Patch first. Apply the vendor-supplied update or remediation named in the F5 advisory for CVE-2026-94127 on every affected BIG-IP APM instance. Follow F5’s install, failover, and verification procedures so HA pairs and traffic groups remain consistent.

• After upgrade, re-validate that access policies and OAuth profiles still behave as intended in a controlled test path.
• Remove or avoid unnecessary combinations of access policy plus OAuth profile on virtual servers if your design no longer requires them.
• Harden management access: restrict the management interface to jump hosts or admin networks, enforce strong authentication, and keep separate admin credentials from data-plane user stores.
• Reduce internet exposure of APM listeners where business needs allow; prefer private connectivity or tightly controlled reverse-proxy patterns.
• Align change windows and evidence collection with CISA BOD 26-04 prioritization and any applicable forensics triage expectations for federal or regulated environments.

Known ransomware use is not documented for this CVE in the provided facts; still treat successful RCE as a full host compromise until proven otherwise.

If you can't patch immediately

Use compensating controls only as a bridge to the vendor fix—not as a substitute.

• Configuration: Where operationally feasible, disable or detach the OAuth profile and/or access policy combination on exposed virtual servers until you can patch, if the vendor advisory supports that as a mitigation.
• Exposure reduction: Place APM behind allowlists, VPN-only admin paths, or network segments that limit who can reach the vulnerable service. Block untrusted source ranges at the edge firewall.
• Virtual patching: If you operate a WAF or reverse proxy in front of APM, apply vendor- or lab-validated rules that constrain abnormal request sizes or patterns against APM/OAuth URIs—without inventing signatures. Tune carefully to avoid breaking legitimate OAuth flows.
• Segmentation and least privilege: Isolate BIG-IP from crown-jewel networks so a compromised APM host cannot freely reach directory services, CI/CD, or backup systems.
• Monitoring: Increase logging on APM and surrounding firewalls; alert on process instability, unexpected admin logins, and new persistence. Preserve volatile evidence if you suspect active exploitation.
• Cloud or managed use: Follow BOD 26-04-oriented guidance for cloud services, or discontinue use if mitigations cannot be applied, as directed in the CISA required action summary.

If your data may have been exposed

Actively exploited remote code execution flaws on edge access gear frequently lead to credential theft, session abuse, lateral movement, and data exposure even when ransomware use is not documented. If exploitation is suspected, isolate the device, preserve logs and images per your IR plan and any CISA forensics triage requirements, rotate secrets that traversed APM (including OAuth client material and admin credentials), and review downstream systems for follow-on access.

You can run a free exposure scan of your email addresses against known breach datasets to see whether your identities already appear in public breach collections, then prioritize password resets and MFA on accounts that reused those credentials.