Security
Loading…

CVE-2026-94127

CRITICALCVSS 9.8Known Exploited
Description

F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.

Timeline
Published:September 22nd, 2026 3:17 PM
Last modified:September 23rd, 2026 2:32 PM
Added to KEV:September 22nd, 2026
CVSS Scoring

CVSS v3: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Software
From NVD CPE configuration data

Vendors

f5

Products

big-ip_access_policy_manager
Weaknesses (CWE)

Source: NIST NVD · Data may lag official sources by up to one minute