CVE-2026-94127Active Exploitation(f5 / big-ip_access_policy_manager)

CRITICALCVSS 9.3 · CRITICALCISA KEV

Exploitation observed; activity peaked at 79 mentions and remains active

Immediate actions

Patch f5 big-ip_access_policy_manager systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

f5 CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-25. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor / third-party advisories

https://my.f5.com/manage/s/article/K000162605

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127

Weakness type (CWE)

CWE-122

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

big-ip_access_policy_manager

Threat summary

Active exploitation appears in 137 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
206 mentions across 18 observed days

What's happening

Active exploitation reported across 137 signals
Exploit tool or code specified in 9 signals
PoC mentioned or linked in 16 signals
Patch or workaround mentioned in 98 signals
Technical details provided in 172 signals
Disclosure: 37 classified signals
Peaked 16d ago at 79 mentions (2026-09-23); latest day: 1
206 total mentions across 18 days

Affected systems

Vendors

Products

big-ip_access_policy_manager

1 version affected across 1 product

Deep dive

Activity timeline206 mentions / 18d

Signal classification6 categories

Active Exploitation

13766.5%

Disclosure

3718.0%

Patch

115.3%

General

115.3%

PoC

62.9%

Exploit

41.9%

Referenced assets137 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-22	19	Active Exploitation12Disclosure5Patch1PoC1
2026-09-23	79	Active Exploitation63Disclosure10General3Patch3
2026-09-24	47	Active Exploitation23Disclosure12Exploit2General6Patch2PoC2
2026-09-25	22	Active Exploitation13Disclosure5Exploit1Patch1PoC2
2026-09-26	11	Active Exploitation8Disclosure1Exploit1PoC1
2026-09-27	3	Active Exploitation2Disclosure1
2026-09-28	8	Active Exploitation6Disclosure1General1
2026-09-29	3	Active Exploitation2Disclosure1
2026-09-30	2	Active Exploitation2
2026-10-01	2	Disclosure1General1
2026-10-02	1	Active Exploitation1
2026-10-05	1	Patch1
2026-10-06	1	Active Exploitation1
2026-10-07	3	Active Exploitation1Patch2
2026-10-08	1	Active Exploitation1
2026-10-12	1	Patch1
2026-10-17	1	Active Exploitation1
2026-10-25	1	Active Exploitation1

Full discourse20 posts

watchTowr@watchtowrcyber45d
Disclosure
F5, BIG-IP, a 20-year-old primitive, a security appliance, an "authentication" mechanism - and a CISA promise ring. Yes, it's CVE-2026-94127. Give us strength. Speak soon xo https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127
Post summary
The tweet announces CVE-2026-94127 related to F5 BIG-IP and links to a detailed analysis, but lacks explicit PoC, exploit tools, or active exploitation claims within the tweet text itself.
129715355195100.5K
14.3K followersView on X
watchTowr@watchtowrcyber44d
Exploit
bada bing bada boom https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127/
Post summary
The post shares a link to a GitHub repository that appears to contain an exploit for CVE-2026-94127, a pre-authentication remote code execution vulnerability in F5 BIG-IP.
23541193110.4K
14.3K followersView on X
The Hacker News@TheHackersNews45d
Active Exploitation
‼️ WARNING - F5’s BIG-IP APM 0-day is being exploited for unauthenticated RCE. CVE-2026-94127 affects systems where APM acts as an OAuth authorization server. F5 has released hotfixes, and CISA added the flaw to KEV. What to patch and check: https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html
Post summary
CVE‑2026‑94127 is a zero‑day in F5 BIG‑IP APM that is actively exploited for unauthenticated RCE; F5 has released hotfixes and CISA has added it to the KEV list.
24021032934.3K
2.4M followersView on X
Dark Web Informer@DarkWebInformer45d
General
CVE-2026-94127 👇
Post summary
The tweet merely references CVE-2026-94127 with an arrow emoji, offering no additional details about PoC, exploits, patches, or active exploitation.
1100784518.9K
243.5K followersView on X
FOFA@fofabot45d
Active Exploitation
⚠️⚠️ CVE-2026-94127 (CVSS 9.8): Heap overflow in F5 BIG-IP APM OAuth processing -> unauthenticated RCE on internet-facing VPN/identity gateways. Now actively exploited. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJmNS1CSUdJUCI= 🎯1.5M+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="f5-BIGIP" 🔖Refer: https://www.cert.europa.eu/publications/security-advisories/2026-013 #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
CVE‑2026‑94127 is a CVSS 9.8 heap overflow in F5 BIG‑IP APM that yields unauthenticated remote code execution and is reported as actively exploited, posing an urgent threat to exposed VPN and identity gateways.
216064294.1K
14.8K followersView on X
Nicolas Krassas@Dinosn45d
Disclosure
CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm
Post summary
The tweet announces CVE-2026-94127 as a critical unauthenticated remote code execution flaw in F5 BIG-IP APM and links to a Rapid7 blog post for further details.
021062215.3K
162.6K followersView on X
🅰🅳🅼@securityfreax41d
Disclosure
My CSIRT week as the "incident handler on duty" so far: CVE-2026-94127 (F5 BIG-IP APM) CVE-2026-87902 (WordPress Core) CVE-2026-65660 (MS SharePoint) CITRIX Netscaler Zero Day KITEWORKS Zero Day https://t.co/AjyMG0eHa9
Post summary
The tweet serves as a brief announcement/inventory of multiple CVEs and zero-days without technical details, exploit code, patches, or exploitation status.
85159176.9K
4.3K followersView on X
Nicolas Krassas@Dinosn44d
Disclosure
Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) - watchTowr Labs https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/
Post summary
The text serves as a disclosure announcement for CVE-2026-94127, highlighting critical technical details of an unauthenticated heap overflow in F5 BIG-IP leading to RCE via the Auth Header, without mentioning patches, exploits, or active attacks.
010037125.3K
162.6K followersView on X
Rıdvan Yağlı@ridvanyagli45d
Active Exploitation
🔴 F5 BIG-IP APM'de kimlik doğrulamasız RCE'ye yol açan kritik heap overflow açığı CVE-2026-94127 Heap-based buffer overflow (CWE-122) olarak takip edilen açık, belirli OAuth Authorization Server yapılandırmalarında uzaktan kod çalıştırılmasına izin veriyor. CVSS 9.8 ve aktif olarak istismar edildiği F5 tarafından doğrulandı; CVEs CISA KEV'e de eklendi. https://x.com/SinSinology/status/2102901248068309498/video/1
Post summary
The tweet reports CVE-2026-94127, a critical heap overflow enabling unauthenticated RCE on F5 BIG-IP APM, confirming active exploitation via F5 validation and CISA KEV inclusion with a CVSS 9.8 score.
17135134.9K
2.5K followersView on X
Dark Web Informer@DarkWebInformer44d
PoC
‼️[POC] CVE-2026-94127: When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE) GitHub: https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127/ https://t.co/OY30QwP2z6
Post summary
The tweet announces the public release of a Proof-of-Concept (PoC) exploit for CVE-2026-94127, a pre-authentication RCE in F5 BIG-IP APM/OAuth configurations, providing a GitHub link to the code and technical trigger details.
26033128.9K
243.5K followersView on X
Justin Elze@HackingLZ44d
General
No public/github CVE-2026-94127 F5 BIG-IP APM exploit yet?
Post summary
The post is a simple query asking whether a public exploit for CVE-2026-94127 in F5 BIG-IP APM has been released, without providing any technical details, PoC, exploit code, exploitation reports, or patch information.
9203365.3K
74.0K followersView on X
Rapid7@rapid745d
Disclosure
🚨 On 9/22/26, #F5 published a security advisory for CVE-2026-94127 – a critical heap-based buffer overflow vuln. affecting F5 BIG-IP APM. An unauth. attacker with network access to an affected virtual server may be able to achieve RCE. More in our blog: https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm/ https://t.co/fIwhdDFGv2
Post summary
On September 22, 2026, F5 issued a security advisory for CVE-2026-94127, a critical heap-based buffer overflow in BIG-IP APM allowing unauthenticated RCE. The tweet provides technical details but does not mention a PoC, exploit, patch, or active exploitation.
39121105.2K
126.0K followersView on X
JPCERTコーディネーションセンター@jpcert44d
Active Exploitation
F5 BIG-IP Access Policy Managerにおけるヒープベースのバッファオーバーフローの脆弱性（CVE-2026-94127）に関する注意喚起を公開。OAuth認可サーバー構成の仮想サーバーが影響を受けます。悪用あり、詳細情報公表済みのため、対策や侵害調査を実施してください。^MH https://www.jpcert.or.jp/at/2026/at260028.html
Post summary
JPCERT warns of CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP APM affecting OAuth virtual servers, with confirmed active exploitation; users are urged to apply countermeasures and conduct breach investigation.
1822046.5K
37.4K followersView on X
Sekurak@Sekurak44d
Patch
Rozwiązanie F5 ADC - zdalne wykonanie poleceń (jako root) na urządzeniu. ❌ Przez buffer overflow w logowaniu 😂 A dokładniej w nagłówku HTTP Authorization. ✅ Podatność CVE-2026-94127 właśnie załatano (dotyczy wdrożeń z włączonym OAuth2). Aha, pokazano już w działaniu exploit, wiec nie są to jakieś tam dywagacje cyberfilozofów ;)
Post summary
The text announces a patch for CVE-2026-94127 in F5 ADC, a buffer overflow in the HTTP Authorization header enabling remote command execution, and confirms the vulnerability has been fixed. It also notes that an exploit was demonstrated, but emphasizes the availability of a patch as the primary action.
2202724.7K
45.2K followersView on X
TRSiber | Siber Bilgi Ağı@trsiberyazilim44d
Active Exploitation
💢 F5 BIG-IP APM'de sıfırıncı gün açığı aktif saldırıda: CVE-2026-94127 kimlik doğrulamasız kod çalıştırmaya izin veriyor. CISA, federal kurumlara 25 Eylül'e kadar süre verdi. Detaylar 👇 https://siberhaber.org/haber/f5-big-ip-apm-cve-2026-94127-sifirinci-gun-acigi/ #SonDakika #Gündem #F5 #BIGIP #CVE #SiberGüvenlik #CISA
Post summary
The tweet alerts that CVE-2026-94127, a zero-day RCE in F5 BIG-IP APM, is actively exploited in the wild and cites a CISA directive for federal agencies to remediate by September 25.
010320193
440 followersView on X
Andy Swift@SwiftSecur144d
Disclosure
https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/ This is utterly bonkers. Its a fun read if you have a few mins. We use system wide ASLR - HAZZAH! ... PIE is for loosers though so...lets not bother with that.
Post summary
The tweet shares a link to a WatchTowr lab post detailing CVE-2026-94127, an unauthenticated heap overflow in F5 BIG-IP leading to RCE, with technical commentary on ASLR and PIE. No exploit, patch, or active exploitation is mentioned.
1402071.3K
1.3K followersView on X
Rıdvan Yağlı@ridvanyagli44d
Exploit
CVE-2026-94127 — F5 BIG-IP APM Pre-Auth RCE için Exploit yayınlandı: https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127/
Post summary
The text announces the publication of a functional exploit for CVE-2026-94127 (F5 BIG-IP APM Pre-Auth RCE) with a linked GitHub repository, emphasizing the vulnerability's technical details and exploit code availability. No active exploitation in the wild or patch information is mentioned.
0202272.2K
2.5K followersView on X
Mike Felch (Stay Ready)@ustayready44d
Disclosure
F5 BIG-IP UnAuth Heap-Overflow to RCE "It is 2026, AGI is here, and we are still writing overflow 101 vulnerability analyses." -Watchtowr what a way to close that blog out LOL https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/
Post summary
The tweet announces an unauthenticated heap overflow vulnerability in F5 BIG-IP (CVE-2026-94127) leading to RCE, citing technical details but lacking any mention of exploitation, patches, or debunking.
1302231.3K
17.5K followersView on X
/r/netsec@_r_netsec45d
Disclosure
Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) - watchTowr Labs https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/
Post summary
The tweet announces CVE-2026-94127 on F5 BIG-IP, describing it as an unauthenticated heap overflow leading to RCE via a watchTowr Labs research link. It provides technical details about the vulnerability but does not explicitly confirm a PoC, named exploit tool, patch, or active exploitation within the text.
0301681.8K
34.3K followersView on X
Frank@jedisct144d
Disclosure
Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/
Post summary
The tweet announces the disclosure of a newly identified F5 BIG-IP heap‑overflow vulnerability (CVE‑2026‑94127) that can lead to remote code execution, directing readers to a detailed blog while providing no PoC, exploit code, patch, or evidence of active exploitation.
1001661.8K
18.2K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	f5	big-ip_access_policy_manager	-	-	-
App	f5	big-ip_access_policy_manager	21.1.0	-	-

Explore more

Back to dashboard f5 CVEs big-ip_access_policy_manager vulnerabilities

What researchers are saying

CVE-2026-94127

watchTowr[verified]@watchtowrcyberDisclosure

The tweet announces CVE-2026-94127 related to F5 BIG-IP and links to a detailed analysis, but lacks explicit PoC, exploit tools, or active exploitation claims within the tweet text itself.

watchTowr[verified]@watchtowrcyberExploit

The post shares a link to a GitHub repository that appears to contain an exploit for CVE-2026-94127, a pre-authentication remote code execution vulnerability in F5 BIG-IP.

FOFA[verified]@fofabotActive Exploitation

CVE‑2026‑94127 is a CVSS 9.8 heap overflow in F5 BIG‑IP APM that yields unauthenticated remote code execution and is reported as actively exploited, posing an urgent threat to exposed VPN and identity gateways.

Nicolas Krassas[verified]@DinosnDisclosure

The tweet announces CVE-2026-94127 as a critical unauthenticated remote code execution flaw in F5 BIG-IP APM and links to a Rapid7 blog post for further details.

🅰🅳🅼[verified]@securityfreaxDisclosure

The tweet serves as a brief announcement/inventory of multiple CVEs and zero-days without technical details, exploit code, patches, or exploitation status.

Nicolas Krassas[verified]@DinosnDisclosure

The text serves as a disclosure announcement for CVE-2026-94127, highlighting critical technical details of an unauthenticated heap overflow in F5 BIG-IP leading to RCE via the Auth Header, without mentioning patches, exploits, or active attacks.

Rıdvan Yağlı[verified]@ridvanyagliActive Exploitation

The tweet reports CVE-2026-94127, a critical heap overflow enabling unauthenticated RCE on F5 BIG-IP APM, confirming active exploitation via F5 validation and CISA KEV inclusion with a CVSS 9.8 score.

Justin Elze[verified]@HackingLZGeneral

The post is a simple query asking whether a public exploit for CVE-2026-94127 in F5 BIG-IP APM has been released, without providing any technical details, PoC, exploit code, exploitation reports, or patch information.