CVE-2026-94127: F5 BIG-IP APM: unauthenticated RCE via OAuth server

CRITICALACTIVELY EXPLOITEDCISA: ACT

Published September 22, 2026

CISO Take

CVE-2026-94127 is a heap-based buffer overflow (CWE-122) in F5 BIG-IP Access Policy Manager that lets an unauthenticated attacker run code remotely over the network. It affects only systems where APM acts as an OAuth Authorization Server, with an access policy and OAuth profile on a virtual server, and Appliance mode is also vulnerable. CISA added it to the KEV catalog on 22 September 2026 with a 25 September remediation deadline, and its SSVC decision is ACT, so exploitation is confirmed even though the EPSS score is only 0.022 (top 18%) and no public exploit or Nuclei template exists. The AI link is indirect: BIG-IP often fronts model-serving APIs, inference gateways and AI platforms, so a compromised appliance exposes the traffic, tokens and credentials flowing through it. Apply the fixed release from F5 advisory K000162605 now, and if you cannot patch immediately, remove or restrict the OAuth Authorization Server profile and hunt for compromise on any exposed APM virtual server.

Sources:NVDCISA KEVEPSSCISA SSVCmy.f5.comATLAS

What is the risk?

Overall risk is critical. CVSS 9.8 (network, low complexity, no privileges, no user interaction), CISA KEV listing and an SSVC decision of ACT confirm real-world exploitation. The low EPSS (0.022) and absence of a public exploit or scanner template do not reduce urgency, because KEV status already shows attackers have working exploits. Exposure is limited to deployments with APM configured as an OAuth Authorization Server. There is no control-plane exposure, but the data plane is reachable from wherever the virtual server is published, often the internet. Versions past End of Technical Support were not evaluated, so they may be vulnerable with no fix available. Direct AI/ML risk is indirect: the product is not an AI component, and the package context shows no AI packages, dependents or OpenSSF data.

How does the attack unfold?

Initial Access

Attacker sends crafted network traffic to a BIG-IP virtual server configured with APM as an OAuth Authorization Server.

AML.T0049

Exploitation

The heap buffer overflow in the data plane is triggered, giving unauthenticated remote code execution on the appliance.

Credential Access

Attacker harvests OAuth tokens, session material and TLS keys handled by the appliance.

AML.T0091.000

Impact

Attacker intercepts traffic or pivots to AI inference APIs and ML infrastructure behind the gateway.

Initial Access

Attacker sends crafted network traffic to a BIG-IP virtual server configured with APM as an OAuth Authorization Server.

AML.T0049

Exploitation

The heap buffer overflow in the data plane is triggered, giving unauthenticated remote code execution on the appliance.

Credential Access

Attacker harvests OAuth tokens, session material and TLS keys handled by the appliance.

AML.T0091.000

Impact

Attacker intercepts traffic or pivots to AI inference APIs and ML infrastructure behind the gateway.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

26.6%

chance of exploitation in 30 days

Higher than 98% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Actively Exploited

CISA KEV

Sophistication

Moderate

Exploitation Confidence

high

✓CISA KEV (active exploitation confirmed) — Sep 2026

✓CISA SSVC: Active exploitation

○EPSS exploit prediction: 27%

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Patch immediately to the fixed BIG-IP release listed in F5 advisory K000162605, and meet the CISA KEV deadline of 25 September 2026. 2) Confirm exposure: check whether any virtual server has an APM access policy with an OAuth profile configured as an Authorization Server. Pure OAuth Client/Resource Server setups are not affected. 3) If patching is delayed, remove or disable the OAuth Authorization Server profile, or restrict access to the affected virtual servers to trusted source IPs. 4) Plan upgrades for versions at End of Technical Support, which F5 did not evaluate. 5) Detection: review BIG-IP logs and virtual server traffic for anomalous OAuth requests, unexpected processes or files on the appliance, and unusual outbound connections. Follow F5 indicators-of-compromise guidance. 6) After patching, rotate secrets, OAuth client secrets and signing keys that the appliance handled, if compromise is suspected.

What does CISA's SSVC say?

DecisionAct

Exploitationactive

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAuth BypassAPIFrameworkAML.T0049- Exploit Public-Facing Application AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from previously unknown risks

Frequently Asked Questions

What is CVE-2026-94127?

Is CVE-2026-94127 actively exploited?

Yes, CVE-2026-94127 is confirmed actively exploited and listed in CISA Known Exploited Vulnerabilities catalog since Tue Sep 22 2026 00:00:00 GMT+0000 (Coordinated Universal Time).

How to fix CVE-2026-94127?

1) Patch immediately to the fixed BIG-IP release listed in F5 advisory K000162605, and meet the CISA KEV deadline of 25 September 2026. 2) Confirm exposure: check whether any virtual server has an APM access policy with an OAuth profile configured as an Authorization Server. Pure OAuth Client/Resource Server setups are not affected. 3) If patching is delayed, remove or disable the OAuth Authorization Server profile, or restrict access to the affected virtual servers to trusted source IPs. 4) Plan upgrades for versions at End of Technical Support, which F5 did not evaluate. 5) Detection: review BIG-IP logs and virtual server traffic for anomalous OAuth requests, unexpected processes or files on the appliance, and unusual outbound connections. Follow F5 indicators-of-compromise guidance. 6) After patching, rotate secrets, OAuth client secrets and signing keys that the appliance handled, if compromise is suspected.

What systems are affected by CVE-2026-94127?

This vulnerability affects the following AI/ML architecture patterns: Model serving behind BIG-IP load balancers, API gateways and identity providers for AI platforms, ML platform SSO/OAuth front-ends.

What is the CVSS score for CVE-2026-94127?

CVE-2026-94127 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 26.55%.

What is the AI security impact?

Affected AI Architectures

Model serving behind BIG-IP load balancersAPI gateways and identity providers for AI platformsML platform SSO/OAuth front-ends

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Exploitation Scenario

An attacker scans for internet-facing BIG-IP virtual servers that expose OAuth Authorization Server endpoints, for example one fronting an internal ML platform or LLM gateway. They send specially crafted traffic that triggers the heap overflow in the data plane and achieve unauthenticated code execution on the appliance. From there they harvest OAuth tokens, session cookies and TLS private keys, then use the stolen credentials to call inference APIs, read prompts and responses, or reach model registries and training infrastructure behind the load balancer.

Weaknesses (CWE)

CWE-122Heap-based Buffer OverflowPrimary CWE-122Heap-based Buffer Overflow

CWE-122 — Heap-based Buffer Overflow: The product writes past the end of a buffer that was allocated on the heap.

Pre-design: Use a language or compiler that performs automatic bounds checking.
[Architecture and Design] Use an abstraction library to abstract away risky APIs. Not a complete solution.

Source: MITRE CWE corpus.