Critical RCE Zero-Day in F5 BIG-IP APM

On September 22, 2026, F5 disclosed a critical zero-day vulnerability (CVE-2026-94127) affecting the BIG-IP Access Policy Manager (APM). The vulnerability is a heap-based buffer overflow that allows unauthenticated attackers to achieve remote code execution (RCE) via the data plane. The risk is limited to systems specifically configured as an OAuth Authorization Server with an active OAuth profile and access policy on a virtual server. CISA has added this flaw to the Known Exploited Vulnerabilities (KEV) catalog following confirmed reports of active exploitation.

Technical analysis indicates that malicious traffic targeting the virtual server triggers the overflow, bypasses authentication, and potentially grants total control over the asset. Notably, this is a data plane issue that does not directly expose the BIG-IP management (control) plane but does affect systems in Appliance mode. While no specific threat actor has been named in the report, F5 previously noted that state-sponsored hackers breached its systems in 2025 to steal BIG-IP source code, highlighting the high interest in this platform by sophisticated adversaries.

Immediate remediation is required for organizations using BIG-IP APM for OAuth services. F5 has released engineering hotfixes, and an iRule-based mitigation is available through F5 Support for those unable to patch immediately. FCEB agencies were directed by CISA to remediate or mitigate by September 25, 2026.