Network operators running F5 BIG-IP with Access Policy Manager configured as an OAuth Authorization Server now have a clear path to shut down active exploitation of a critical vulnerability that grants attackers remote code execution. The flaw, tracked as CVE-2026-94127, has been added to CISA’s Known Exploited Vulnerabilities catalog, and F5 has released hotfixes covering every affected release branch.<\/p>\n
CVE-2026-94127 is a critical-severity vulnerability in the BIG-IP Access Policy Manager (APM) module. It carries a CVSS score of 9.8 out of 10. The flaw allows unauthenticated attackers to send malicious traffic to a BIG-IP appliance and achieve remote code execution on the underlying system.<\/p>\n
According to F5’s advisory, the issue is reachable only when a BIG-IP APM access policy and an OAuth profile are configured together on a virtual server, and only when APM is configured as an OAuth Authorization Server. Deployments that use APM as an OAuth Client or Resource Server are not affected. Systems running in Appliance mode are also vulnerable. F5 described the bug as a data plane issue, meaning there is no control plane exposure, and the company discovered the defect internally.<\/p>\n
F5 lists three vulnerable release branches:<\/p>\n
No other F5 products are affected, according to the vendor. Hotfixes have been published for each of the three branches.<\/p>\n
CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog at the same time F5 published its advisory. The catalog listing means federal civilian agencies are required to patch within three days under BOD 26-04. CISA’s KEV listing is widely used by private-sector organizations as a triage signal: any CVE added there has credible evidence of exploitation in the wild, not just a theoretical risk.<\/p>\n
F5 published three indicators of compromise and noted that their combined and frequent appearance should be correlated to an attack rather than each one being treated in isolation. Defenders running affected BIG-IP APM deployments should review logs and traffic records for these IoCs and investigate any matches promptly, especially on systems that have not yet been patched.<\/p>\n
The single most effective step is to apply the hotfix that matches the BIG-IP APM version in use. For environments that cannot patch immediately, the most practical compensating control is to remove the OAuth Authorization Server configuration from any virtual server that also carries an APM access policy, which closes the only known attack path F5 has described. After patching, review the published IoCs against historical logs to identify any prior compromise.<\/p>\n
BIG-IP APM 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3 are vulnerable. F5 has released hotfixes for each branch and says no other products are affected.<\/p>\n
Yes. F5 confirmed exploitation in the wild and CISA added the CVE to its Known Exploited Vulnerabilities catalog on the same day, which triggers a three-day patching deadline for federal civilian agencies.<\/p>\n
The bug is reachable when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, and only when APM is configured as an OAuth Authorization Server. Deployments using APM as an OAuth Client or Resource Server are not affected.<\/p>\n