Description
When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).

Impact:
This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published: 2026-09-22
Score: 9.3 Critical
EPSS: n/a
KEV: Yes
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Workaround

An iRule is available upon request. Open a ticket with F5 support to request this.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-09-22T00:00:00+00:00', 'dueDate': '2026-09-25T00:00:00+00:00'}

Tue, 22 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared F5
F5 big-ip
Vendors & Products F5
F5 big-ip

Tue, 22 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Title BIG-IP APM OAuth vulnerability
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

F5 Big-ip
cve-icon MITRE

Status: PUBLISHED

Assigner: f5

Published:

Updated: 2026-09-22T19:49:24.074Z

Reserved: 2026-09-20T17:39:19.975Z

Link: CVE-2026-94127

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-22T15:17:24.313

Modified: 2026-09-22T19:09:58.680

Link: CVE-2026-94127

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T16:15:08Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow