Unauthenticated heap overflow RCE in F5 BIG-IP APM OAuth profiles (CVE-2026-94127)
F5 disclosed the flaw on 2026-09-22 as a zero-day already exploited for remote code execution and CISA set a KEV due date of 2026-09-25, so any internet-facing APM OAuth virtual server left unpatched is exposed to full device takeover.
A heap-based buffer overflow in BIG-IP APM is reachable when an access policy and an OAuth profile are configured on a virtual server, letting an unauthenticated network attacker execute code on the BIG-IP system. Only deployments where APM acts as an OAuth authorization server are affected.
Affected: F5 BIG-IP APM 21.1.0 prior to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG; F5 BIG-IP APM 17.5.0 prior to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG; F5 BIG-IP APM 17.1.0 prior to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
How to Test
Confirm the BIG-IP version is in the 17.1.x, 17.5.x or 21.1.x affected ranges and whether the APM module is provisioned; then inventory virtual servers that have both an access policy and an OAuth profile attached (APM acting as an OAuth authorization server) — those are the vulnerable exposure points. Review APM and system logs around those virtual servers for malformed OAuth requests, unexpected process crashes or restarts, and unknown processes, files or accounts on the BIG-IP, and follow CISA's forensics triage requirements given confirmed exploitation.
How to Patch
Install the F5 engineering hotfix for your branch: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG (F5 article K000162605). If the hotfix cannot be applied immediately, remove the OAuth profile from affected virtual servers or restrict access to them to trusted sources until patched.