First published 9/27/2026, 5:52:15 AM · Last updated 9/27/2026, 5:52:15 AM

CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

CISA reports a heap-based buffer overflow in F5 BIG-IP APM that can occur when an access policy and an OAuth profile are configured on a virtual server and could allow unauthenticated remote code execution. The advisory directs stakeholders to apply vendor mitigations and follow CISA’s BOD 26-04 patching and forensics triage guidance.

Categories: technology

Generated scores

Scores are based on the cited reporting and use a 1–10 scale. Read the methodology.

Confidence: 6/10How certain the assessment is based on the clarity and evidence in the cited reporting.
Geographic reach: 5/10How widely the event reaches, from a local area (1) to worldwide impact (10).
Global importance: 6/10The event's broader significance, from limited importance (1) to major global importance (10).
Impact magnitude: 6/10The scale or severity of the real-world impact, from minor (1) to extreme (10).
Positivity: 2/10How harmful or beneficial the event is, from strongly harmful (1) to strongly positive (10).
Urgency: 7/10How time-sensitive the event is, from low urgency (1) to immediate attention needed (10).

Why it matters

Affected organizations must evaluate internet exposure and apply mitigations per vendor and CISA guidance to prevent potential remote code execution.

Location

Sources

CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

Report an issue