On September 22, 2026, F5 published an advisory for CVE-2026-94127, a critical heap overflow in BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution in a specific configuration. F5 confirms exploitation, and CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalogue that day. It affects a virtual server configured with an access policy and an OAuth profile when BIG-IP APM acts as the authorization server.
The affected configuration scenario
CVE-2026-94127 is a heap-based overflow that can lead to unauthenticated remote code execution when a virtual server combines an APM access policy and an OAuth authorization-server profile. The advisory does not describe a flaw affecting every BIG-IP deployment: the OAuth role and virtual-server configuration matter.
The Canadian Cyber Centre advisory lists affected 17.1.x, 17.5.x and 21.1.0 branches; the fixed hotfixes are Hotfix-BIGIP-17.1.3.5.0.41.14-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG and Hotfix-BIGIP-21.1.0.2.0.30.22-ENG. Confirm exact versions and builds in F5 advisory K000162605 before making changes.
Why exploitation changes the priority
F5 confirms exploitation, and CISA added CVE-2026-94127 to its KEV catalogue on September 22. This warrants priority remediation, but does not provide a complete victim list or prove that every vulnerable system was compromised.
A compromised BIG-IP APM could nevertheless expose sessions, federation configuration and paths into protected applications. Patching alone is therefore not enough when the interface was reachable from uncontrolled networks.
Priority actions for network teams
Inventory BIG-IP versions and virtual servers combining APM, an access policy and an OAuth authorization-server profile. Apply the hotfix for the relevant branch, as specified by F5. If patching cannot happen immediately, CERT-EU says F5 provides an iRule mitigation for the affected virtual server through F5 Support. A rule that only restricts the management plane does not address this scenario.
Preserve logs before cleanup. Follow F5 and JPCERT/CC detection guidance: repeated OAuth UserInfo request failures in /var/log/apm, an unexplained increase in total_failed, then review /var/log/audit around the same timestamps. Investigate a TMM core file alongside other indicators; its presence alone does not prove compromise. Escalate suspicious combinations to the incident-response team.
Secrets and sessions to review
After potential access, revoke active sessions and rotate service accounts, certificates, keys and passwords used by APM or protected applications. Coordinate rotation with the investigation: it limits reuse of a secret but does not remove persistence already installed.
If the investigation finds unauthorized access, revoke sessions and rotate secrets the appliance could read or use, after preserving evidence needed for analysis. For another documented example of technical-secret rotation after exposure, see our article about the JetBrains-Cadence incident. Users should also be cautious with unexpected messages requesting sign-in after a patch.
The Soclyde connection
Soclyde does not patch BIG-IP APM or revoke sessions for the network team. It can support a controlled rotation by generating unique secrets and keeping them in local-first encrypted vaults instead of configuration spreadsheets copied between suppliers.
That organisation complements the hotfix, network restriction and investigation. It is neither protection for the appliance nor proof that access was not compromised.
Key takeaways
CVE-2026-94127 affects specific BIG-IP APM OAuth configurations and is actively exploited. Confirm the exact scope, apply F5’s fix, look for access traces and rotate affected secrets. To structure the rotation, read the secure password generator guide or contact Soclyde.
