Originally published at HOL
CVE-2026-94127 affects BIG-IP APM only when the affected virtual server is configured for APM to act as an OAuth Authorization Server. F5's current advisory narrows the scope beyond simply having an APM access policy and an OAuth profile on the same virtual server. Deployments that use APM only as an OAuth Client or Resource Server, without an OAuth Authorization Server profile, are not affected by this vulnerability.
CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities catalog on September 22, 2026. F5 describes a heap-based buffer overflow in the BIG-IP APM data plane that can lead to unauthenticated remote code execution when the Authorization Server configuration is present.
Affected versions and fixes
- BIG-IP APM 21.1.0: install
Hotfix-BIGIP-21.1.0.2.0.30.22-ENG - BIG-IP APM 17.5.x: install
Hotfix-BIGIP-17.5.1.9.0.160.12-ENG - BIG-IP APM 17.1.x: install
Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
Software past End of Technical Support is not evaluated in the advisory. Use the F5 article for the current branch-specific fix and support status.
Scope correction
The important configuration boundary is the OAuth Authorization Server role. An APM virtual server is not automatically affected merely because OAuth is present. F5 explicitly excludes deployments that use APM strictly as an OAuth Client or Resource Server and do not configure an OAuth Authorization Server profile on the affected virtual server.
Operator action
Inventory BIG-IP APM virtual servers that are configured as OAuth Authorization Servers, confirm the running BIG-IP version, and install the F5 engineering hotfix for the affected train. For systems already on the listed hotfix, confirm the expected build after maintenance.
What this is not
This is not a vulnerability in every BIG-IP APM deployment. The affected configuration requires the OAuth Authorization Server role. OAuth Client-only and Resource Server-only deployments without an Authorization Server profile are outside the affected scope described by F5.
