F5 BIG-IP APM OAuth RCE hits CISA KEV

CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities catalog today (2026-09-22). F5 published the same-day advisory for BIG-IP Access Policy Manager: when an APM access policy and an OAuth profile share a virtual server, crafted traffic can trigger a heap buffer overflow and remote code execution with no login. Appliance mode is in scope. This is a data-plane bug; the control plane is not the exposure. Federal KEV due date is 2026-09-25. Forensic triage is marked Yes. CISA's notes say apply F5's temporary iRule for triage, then install the vendor hotfix.

This is the operator write-up from the F5 CVE record (K000162605), CISA KEV catalogVersion 2026.09.22, and NVD's received listing. The HOL Guard evidence pack for this CVE, when it lands, is the linked source record; this page is the fix-first summary.

What breaks

F5 rates the issue Critical. CVSS 3.1 base score is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CVSS 4.0 base from the CNA is 9.3. Weakness: heap-based buffer overflow (CWE-122). The precondition is configuration, not "every BIG-IP on the internet": the virtual server must have both an APM access policy and an OAuth profile attached. Under that setup, specific malicious traffic to the virtual server can reach RCE without authentication.

Affected trains from the F5 CNA record:

• 21.1.0 until Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
• 17.5.0 (through the 17.5.1 line in secondary reporting) until Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
• 17.1.0 (through 17.1.3 in secondary reporting) until Hotfix-BIGIP-17.1.3.5.0.41.14-ENG

Software past End of Technical Support is not evaluated. Treat internet-facing APM+OAuth virtual servers as the pager case. BOD 26-04 triage applies because this is same-day KEV.

Who is not in scope

• Virtual servers without both an APM access policy and an OAuth profile. The CNA text gates the bug on that pair. LTM-only VIPs, or APM without OAuth (or OAuth without APM) on the same virtual server, are outside this specific failure mode.
• Control-plane management paths as the attack surface. F5 states this is a data-plane issue with no control-plane exposure. That does not mean the box is safe; it means the exploit rides traffic to the VIP, not the config UI by itself.
• Other BIG-IP modules and NGINX products called out as unaffected in secondary advisory summaries that track K000162605. Confirm against the live F5 article for your licensed modules before you close the ticket.
• Boxes already on the listed engineering hotfixes for your train. The fix is the ENG hotfix named above, not a marketing point release alone.

One operator check

On each BIG-IP that terminates APM, run:

tmsh show sys version
tmsh list ltm virtual one-line | grep -E 'profiles|access-policy|oauth'

Confirm the software build, then inventory every virtual server that shows both an access policy and an OAuth profile. Any VIP that has both is in the KEV blast radius until the matching ENG hotfix is installed (or until you remove one of those two bindings as a temporary reduction of exposure).

If you already use a config-management export, grep the UCS/SCF for oauth profiles attached beside APM access policies on the same virtual server object. That is the same check without interactive tmsh.

How to fix

Install the F5 engineering hotfix for your train, then re-check version:

• 21.1.0: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
• 17.5.x: Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
• 17.1.x: Hotfix-BIGIP-17.1.3.5.0.41.14-ENG

Pull the package from MyF5 per K000162605, stage it in a change window, and verify tmsh show sys version shows the hotfix build after reboot. If you cannot patch immediately, contact F5 Support for the vendor-provided iRule mitigation CISA references for forensic triage, restrict or disable the exposed APM+OAuth virtual servers where business allows, and treat the box as potentially compromised before you trust a late patch. KEV due date: 2026-09-25.

What this is not

This is not a worm that hits every BIG-IP regardless of config. It is unauthenticated RCE, but only after APM access policy and OAuth share a virtual server. It is also not a control-plane auth bypass; the overflow is on the data plane VIP path.

References

• F5 advisory K000162605: https://my.f5.com/manage/s/article/K000162605
• CVE record: https://www.cve.org/CVERecord?id=CVE-2026-94127
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94127
• CISA KEV catalog (catalogVersion 2026.09.22): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• HOL Guard evidence pack: https://hol.org/guard/security/cves/CVE-2026-94127