critical severityConfidence highHistorical record

F5 BIG-IP APM OAuth VIP can run attacker code with no login

Direct answer

F5 BIG-IP APM OAuth VIP can run attacker code with no login, also tracked as CVE-2026-94127 / K000162605 / F5 BIG-IP APM OAuth RCE is a critical-severity threat campaign HOL Guard tracked from Sep 22, 2026 to Sep 22, 2026, verified against 5 primary sources and last reviewed Sep 22, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

F5 disclosed CVE-2026-94127 on 2026-09-22: heap overflow RCE on BIG-IP APM when access policy and OAuth share a VIP. Unauthenticated. Appliance mode included. CISA added it to KEV the same day. Fixed by ENG hotfixes Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. Temporary iRule available via F5 Support for triage before patch.

Also tracked as CVE-2026-94127 · K000162605 · F5 BIG-IP APM OAuth RCE

First observed
Sep 22, 2026
Last observed
Sep 22, 2026
Last reviewed
Sep 22, 2026
Tracking ended
Sep 22, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Secondary reporting expands version ranges to 17.5.0-17.5.1 and 17.1.0-17.1.3; CNA lists branch starts 21.1.0 / 17.5.0 / 17.1.0 lessThan the named ENG hotfixes. Confirm exact build from MyF5 before closing.

  • Only virtual servers with both an APM access policy and an OAuth profile are in the stated blast radius.
  • Control plane is not the exposure path; this is a data-plane VIP issue.
  • EoTS software versions were not evaluated by F5.
  • Exact public POC status is not claimed here.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

No Guard coverage mapping or campaign-specific policy guidance is published for this record.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Disclosure

    F5 publishes BIG-IP APM OAuth RCE advisory K000162605 / CVE-2026-94127

    Sources:F5 K000162605·CVE-2026-94127 CVE record

  2. Registry action

    CISA adds CVE-2026-94127 to KEV catalogVersion 2026.09.22 (due 2026-09-25)

    Source:CISA KEV catalog 2026.09.22

  3. Update

    HOL Guard publishes operator fix write-up

    Source:HOL Guard operator write-up

Publication clock: 6.1 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • F5 BIG-IP APM@21.1.0 / 17.5.x / 17.1.x before ENG hotfixesgenericpackage

Sources

Every claim on this record is traceable to the sources below.

Campaign questions, answered

F5 disclosed CVE-2026-94127 on 2026-09-22: heap overflow RCE on BIG-IP APM when access policy and OAuth share a VIP. Unauthenticated. HOL Guard tracked the campaign from Sep 22, 2026 to Sep 22, 2026.

No. Active tracking ended Sep 22, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 5 primary sources, names 1 reviewed artifact, and was last fully reviewed Sep 22, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Secondary reporting expands version ranges to 17.5.0-17.5.1 and 17.1.0-17.1.3; CNA lists branch starts 21.1.0 / 17.5.0 / 17.1.0 lessThan the named ENG hotfixes. Confirm exact build from MyF5 before closing.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-F71F16D9