# F5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day

Source: https://startwithidentity.com/cves/cve-2026-94127/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2026-94127 is a heap-based buffer overflow (CWE-122) in F5 BIG-IP Access Policy Manager. It is reachable when an APM access policy and an [OAuth](https://startwithidentity.com/standards/oauth-2-0/) profile sit on the same virtual server, and F5 narrowed the condition on September 23 to APM acting as an OAuth authorization server. Deployments that use APM only as an OAuth client or resource server are not affected. Crafted traffic to the virtual server gives an unauthenticated attacker remote code execution. Appliance mode does not help, and because this is data-plane traffic, locking down the management port does not either.

CVSS 3.1 is 9.8 and CVSS 4.0 is 9.3. Affected versions are 17.1.0 to 17.1.3, 17.5.0 to 17.5.1, and 21.1.0, each with an engineering hotfix. F5 published advisory K000162605 on September 22, 2026 and CISA added the flaw to KEV the same day. No attacker has been publicly named.

## Why it matters

An OAuth authorization server mints the access tokens every downstream API trusts. Code execution on that box is not one compromised app: it is the signing keys, the client secrets and the session state for everything the APM fronts. This is the edge-appliance pattern again, but on a token issuer rather than a VPN login page. The parser that reads untrusted protocol input runs with the authority to issue identity.

## What to do

- Check whether any virtual server has an OAuth authorization server profile attached. If none does, you are not exposed to this CVE.
- Install the F5 hotfix for your branch. If you cannot yet, apply the iRule F5 provides, which CISA names as the temporary mitigation for forensic triage.
- Review `/var/log/apm` for bursts of failed OAuth requests. Public indicators are behavioural, not hashes or IPs.

## After you patch

- Rotate the OAuth signing keys and client secrets configured on the APM, then shorten token lifetimes until you have reviewed issuance logs.
- Revoke outstanding refresh tokens issued by the APM authorization server.
- Treat backend applications that accepted APM tokens as in scope for the investigation.

## Sources

- [NVD: CVE-2026-94127](https://nvd.nist.gov/vuln/detail/cve-2026-94127)
- [F5 advisory K000162605](https://my.f5.com/manage/s/article/K000162605)
- [CISA Known Exploited Vulnerabilities catalog, added September 22, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127)
- [The Hacker News, September 23, 2026](https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html)