CVE-2026-94127F5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day
What broke
CVE-2026-94127 is a heap-based buffer overflow (CWE-122) in F5 BIG-IP Access Policy Manager. It is reachable when an APM access policy and an OAuth profile sit on the same virtual server, and F5 narrowed the condition on September 23 to APM acting as an OAuth authorization server. Deployments that use APM only as an OAuth client or resource server are not affected. Crafted traffic to the virtual server gives an unauthenticated attacker remote code execution. Appliance mode does not help, and because this is data-plane traffic, locking down the management port does not either.
CVSS 3.1 is 9.8 and CVSS 4.0 is 9.3. Affected versions are 17.1.0 to 17.1.3, 17.5.0 to 17.5.1, and 21.1.0, each with an engineering hotfix. F5 published advisory K000162605 on September 22, 2026 and CISA added the flaw to KEV the same day. No attacker has been publicly named.
Why it matters
An OAuth authorization server mints the access tokens every downstream API trusts. Code execution on that box is not one compromised app: it is the signing keys, the client secrets and the session state for everything the APM fronts. This is the edge-appliance pattern again, but on a token issuer rather than a VPN login page. The parser that reads untrusted protocol input runs with the authority to issue identity.
What to do
- Check whether any virtual server has an OAuth authorization server profile attached. If none does, you are not exposed to this CVE.
- Install the F5 hotfix for your branch. If you cannot yet, apply the iRule F5 provides, which CISA names as the temporary mitigation for forensic triage.
- Review
/var/log/apmfor bursts of failed OAuth requests. Public indicators are behavioural, not hashes or IPs.
After you patch
- Rotate the OAuth signing keys and client secrets configured on the APM, then shorten token lifetimes until you have reviewed issuance logs.
- Revoke outstanding refresh tokens issued by the APM authorization server.
- Treat backend applications that accepted APM tokens as in scope for the investigation.
Sources
Related identity CVEs
Related on Start with Identity
- BlogRemote access appliances are credential vaults, so patch day has to be rotation day
Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A p
- CVEBeyondTrust Remote Support zero-day, from file upload to the whole credential vault
An origin-validation flaw in self-hosted BeyondTrust Remote Support through 26.2.3 let ARMORY CASTLE plant a web shell, export every vaulted admin credential, a
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- CVEIvanti Connect Secure root escalation, the last link in the UTA0576 chain
The privilege escalation UTA0576 chained with CVE-2026-104935 to reach root on fully patched Ivanti Connect Secure VPNs, then mine Active Directory. Patched Oct
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me