Remote Code Execution Vulnerability in F5 BIG-IP APM
CVE-2026-94127

9.3CRITICAL

Key Information:

Vendor: F5
Status: Big-ip
Vendor: CVE Published:; 22 September 2026

Badges

🥇 Trended No. 1📈 Trended📈 Score: 11,600👾 Exploit Exists🟡 Public PoC🦅 CISA Reported📰 News Worthy

What is CVE-2026-94127?

CVE-2026-94127 is a significant remote code execution vulnerability found in F5's BIG-IP APM, which serves as an access management tool primarily used to manage secure access to applications and services. This vulnerability arises when the BIG-IP APM is configured as an OAuth Authorization Server, leading to potential exploitation through malicious traffic that could allow an unauthenticated attacker to execute arbitrary code remotely. The implications of this vulnerability are particularly severe, as successful exploitation could enable attackers to gain unauthorized control over the affected systems, potentially compromising sensitive data and disrupting organizational operations.

It is important to note that the vulnerability does not affect all configurations of the BIG-IP APM. Specifically, deployments that solely utilize APM as an OAuth Client or Resource Server are not susceptible. However, organizations that have configured APM with OAuth authorization server profiles must take immediate action, as the vulnerability is exploitable in systems operating in Appliance mode, indicating a significant exposure risk.

Potential Impact of CVE-2026-94127

Unauthorized System Control: Exploitation of this vulnerability could allow attackers to execute arbitrary code remotely, effectively granting them unauthorized control over the BIG-IP APM and possibly enabling them to launch more comprehensive attacks within the organization's network.
Data Breaches: With the ability to execute remote code, an attacker could access, manipulate, or exfiltrate sensitive organizational data, posing a serious risk to data integrity and confidentiality.
Operational Disruption: The successful exploitation of CVE-2026-94127 could lead to disruptions in service, affecting the availability of applications and services managed by BIG-IP APM, which may result in significant operational downtime and financial losses for the organization.

CISA has reported CVE-2026-94127

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-94127 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

BIG-IP 21.1.0

BIG-IP 17.5.0

BIG-IP 17.1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-94127
Created by FurkanKAYAPINAR

News Articles

It Security News

CVE-2026-94127

F5 Fixes BIG-IP APM Zero-Day Enabling Unauthenticated RCE - IT Security News

2026-09-24 19:09 BIG-IP Access Policy Manager (APM) vulnerabilities have been patched by F5 as a result of zero-day attacks utilizing this vulnerability, which allows unauthenticated...

3 weeks ago