Critical RCE Vulnerability in F5 BIG-IP APM

CVE-2026-94127 is a critical remote code execution vulnerability impacting F5 BIG-IP Access Policy Manager (APM). The vulnerability occurs specifically when an OAuth profile is associated with a virtual server configuration. An unauthenticated remote attacker can leverage this flaw by sending specially crafted malicious traffic to the BIG-IP system, bypassing authentication and leading to arbitrary code execution within the data plane.

This issue affects the system even when configured in Appliance mode. Because it is a data plane vulnerability, the attack does not require control plane access to trigger. Given the critical CVSS v3.1 score of 9.8 and the ease of unauthenticated exploitation, this represents a significant risk to organizations utilizing BIG-IP APM for identity and access management. F5 has confirmed this impact across supported versions, though versions that have reached End of Technical Support (EoTS) have not been evaluated for this specific flaw. Defenders should prioritize identifying instances where OAuth profiles are active on virtual servers.

Impact

Successful exploitation of CVE-2026-94127 grants an attacker unauthenticated code execution on the BIG-IP device. This compromises the integrity and confidentiality of the F5 appliance, potentially allowing an attacker to intercept or manipulate proxied traffic, steal session tokens, or establish a persistent foothold within the network perimeter. The vulnerability affects both standard BIG-IP deployments and those in Appliance mode.

Recommendation

Prioritized actions for security teams:

• Identify all BIG-IP APM virtual servers that have an OAuth profile explicitly configured.
• Apply the vendor-provided security patches for CVE-2026-94127 immediately upon release.
• Implement strict ingress filtering and monitor for anomalous HTTP traffic directed at virtual servers utilizing OAuth profiles until patching is complete.
• Review BIG-IP system logs for unauthorized process execution or unexpected service disruptions on devices hosting OAuth-enabled virtual servers.