# CVE-2026-94127: F5 BIG-IP APM heap-based buffer overflow

Source: https://junglewise.ai/threats/cve-2026-94127-f5-big-ip-apm-heap-based-buffer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-94127 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-09-22

F5 BIG-IP APM is a network access and authentication system used to protect corporate resources and manage user access policies. A heap-based buffer overflow vulnerability exists when an access policy and OAuth profile are configured together, allowing unauthenticated attackers to execute arbitrary code remotely, potentially compromising the entire network infrastructure protected by the device.

Technologies: [F5 BIG-IP APM](https://junglewise.ai/threats/technologies/big-ip-apm). Vendors: [F5](https://junglewise.ai/threats/vendors/f5).

## Quick answers

**Is CVE-2026-94127 exploited in the wild?** Yes. CVE-2026-94127 is known to be exploited in the wild, first recorded on 22 September 2026. Treat it as urgent.

**How severe is CVE-2026-94127?** Critical severity, with a CVSS score of 9.8, published 22 September 2026.

**Which products and versions are affected?** F5 BIG-IP APM.

**Is there a fix for CVE-2026-94127?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-94127 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-94127?** Check whether you run F5 BIG-IP APM. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in F5 BIG-IP APM's OAuth authentication handling when both an access policy and OAuth profile are simultaneously configured on a virtual server. The vulnerability resides in the policy engine's credential processing logic and is reachable over the network without prior authentication. An attacker can send a specially crafted request to the affected virtual server to trigger the buffer overflow, leading to heap memory corruption and remote code execution with the privileges of the BIG-IP process. The vulnerability has been observed actively exploited in the wild, indicating public exploit code or active attack campaigns are operational. Patches should be obtained directly from F5 for affected BIG-IP versions.

## Affected products

- F5 BIG-IP APM

## Timeline

- 2026-09-22: disclosed
- exploited: Known to be actively exploited in the wild

## Related threats

- [F5 BIG-IP TMM use-after-free in PEM iRules](https://junglewise.ai/threats/cve-2026-41218-f5-big-ip-tmm-use-after-free-in-pem-irules)
- [F5 BIG-IP APM buffer overflow in apmd process](https://junglewise.ai/threats/cve-2026-40067-f5-big-ip-apm-buffer-overflow-in-apmd-process)