Full Report
Good news: there's a patch. Bad news: both CISA and F5 warn that it's under active exploitation
Analysis Summary
# Vulnerability: F5 BIG-IP APM Heap-Based Buffer Overflow
## CVE Details
- **CVE ID:** CVE-2026-94127
- **CVSS Score:** 9.3 (Critical) - CVSS v4.0
- **CWE:** CWE-122 (Heap-based Buffer Overflow)
## Affected Systems
- **Products:** F5 BIG-IP Access Policy Manager (APM)
- **Versions:** Not explicitly listed in the source text (Users should refer to the F5 advisory for specific versioning).
- **Configurations:** The vulnerability exists only when the system is configured as an **OAuth Authorization Server**, with both an **access policy** and an **OAuth profile** assigned to the same virtual server.
## Vulnerability Description
CVE-2026-94127 is a heap-based buffer overflow vulnerability. In the context of the BIG-IP APM, this flaw allows a remote attacker to overflow memory buffers during the processing of OAuth requests. By sending specially crafted traffic to a vulnerable virtual server, an attacker can achieve remote code execution (RCE) with the privileges of the underlying process.
## Exploitation
- **Status:** Exploited in the wild (Active exploitation confirmed by F5 and CISA).
- **Complexity:** Low (Implied by the critical RCE nature and active exploitation).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Potential for full system compromise and data theft).
- **Integrity:** High (Ability to execute malicious code).
- **Availability:** High (Potential for system crashes or complete takeover).
## Remediation
### Patches
- F5 has released security updates to address this flaw. Administrators are urged to update to the fixed versions immediately as per F5 Security Advisory K000162605.
### Workarounds
- The source text does not specify a configuration-based workaround other than applying the official patch. Organizations unable to patch immediately should evaluate the necessity of the OAuth Authorization Server configuration on exposed virtual servers.
## Detection
- **Indicators of Compromise:** Users should monitor for unusual administrative activity, unexpected outbound connections from BIG-IP appliances, or signs of unauthorized access to enterprise resources mediated by the APM.
- **Detection methods and tools:** CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog. Federal agencies are mandated to remediate by the specified deadline (Friday). Security teams should utilize F5-specific diagnostic tools to check for exploitation attempts in logs.
## References
- **F5 Security Advisory:** hxxps[://]my[.]f5[.]com/manage/s/article/K000162605
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127
- **CVE Record:** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-94127