DaystoPatch

F5Exploited incident

BIG-IP APM OAuth authorization server heap overflow allowing unauthenticated RCE

CVE-2026-94127Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 22 Sep 2026

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE record CVE-2026-94127 (CNA: F5)CuratedQuote verified

    "assignerShortName":"f5","dateReserved":"2026-09-20T17:39:19.975Z","datePublished":"2026-09-22T14:17:42.730Z"

    F5's own disclosure (K000162605, which states in-the-wild exploitation per the Canadian Cyber Centre and others) is the earliest public signal found. The K article is JavaScript-only and could not be quoted.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2fd00cfe97a78c24…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    CISA KEV (CVE-2026-94127)ClaimedQuote verified22 Sep 2026

    F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

    Added to CISA's KEV catalog on 2026-09-22.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Canadian Centre for Cyber Security alert AL26-022CuratedQuote verified22 Sep 2026

    F5 has indicated that CVE-2026-94127 is being exploited in the wild.

    Alert dated 'September 22, 2026'. Government CERT alert; source_kind 'news' is the closest available kind.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:9b5f48483a50fa89…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-94127ClaimedQuote verified22 Sep 2026, 14:17 UTC

    When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2fd00cfe97a78c24…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet22 Sep 2026, 15:20 UTC

    CVE-2026-94127 - big-ip

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet22 Sep 2026, 16:27 UTC

    An exploited BIG-IP APM vulnerability tracked as CVE-2026-94127 allows RCE attacks. Secure your BIG-IP APM vulnerability deployments with new F5 hotfixes. # F5 # BIGIP # CVE202694127 # Cybersecurity # InfoSec # RCE # Vulnerability

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: watchtowrClaimedQuote verified23 Sep 2026, 23:19 UTC

    Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)

    Earliest mention we hold (a vetted outlet).

    Source
    Research: watchtowr research
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0d89ad0e6238f050…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE record CVE-2026-94127 (CNA: F5)CuratedQuote verified

    "datePublished":"2026-09-22T14:17:42.730Z"

    Cyber Centre: 'the vendor advisory released on September 22, 2026'.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2fd00cfe97a78c24…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    date onlysame day

    CVE record CVE-2026-94127 (CNA: F5), workarounds fieldCuratedQuote verified

    An iRule is available upon request.

    The record was updated at 2026-09-23T03:55Z, so it is not certain the workaround text was in the first version; Rapid7's post (update log 'September 22, 2026: Initial publication') also describes the iRule. Day precision for that reason.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2fd00cfe97a78c24…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    at disclosure

    CVE record CVE-2026-94127 (CNA: F5), affected versionsCuratedQuote verified

    "version":"17.1.0","lessThan":"Hotfix-BIGIP-17.1.3.5.0.41.14-ENG"

    Fixes are engineering hotfixes listed at disclosure for 21.1.0, 17.5.0 and 17.1.0. The Hacker News: 'F5 disclosed it in an advisory on September 22 and has released engineering hotfixes.'

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2fd00cfe97a78c24…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Rapid7 Emergent Threat ResponseCuratedQuote verified22 Sep 2026

    F5 lists the following affected release trains and corresponding fixed hotfixes:

    Rapid7: 'On September 22, 2026, F5 published a security advisory for CVE-2026-94127'. Day-precision companion to the CVE-record candidate. Upper bound: engineering hotfixes may have been available on request earlier.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:14b8fda7e323797e…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Rapid7 Emergent Threat ResponseCuratedQuote verified

    BIG-IP 17.1.0: update to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG or later.

    Rapid7 dates F5's advisory 'On September 22, 2026' (day only; R5: the CVE record's 14:17Z is not borrowed). All three affected trains had an engineering hotfix in F5's initial advisory. No later final maintenance release was evidenced.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:14b8fda7e323797e…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

F5 BIG-IP APM flaw exploited before disclosure; hotfixes since Sep 22

Attackers exploited a BIG-IP APM bug that allows remote code execution without a login, and F5 published hotfixes and an iRule mitigation on 22 September 2026.

In plain words

F5's BIG-IP access gateway had a critical flaw that attackers were already using to take over devices without logging in, but only on setups that use it to issue OAuth sign-in tokens. F5 published hotfixes and a temporary mitigation on 22 September 2026. If we use BIG-IP APM in that role, we need the hotfix installed and the device checked for signs of compromise.

What happened and who is affected

What happened

On 22 September 2026 F5 disclosed CVE-2026-94127, a heap buffer overflow in BIG-IP Access Policy Manager when it acts as an OAuth authorization server, and said it was being exploited in the wild. Specially crafted traffic lets an unauthenticated attacker run code on the device. F5 released engineering hotfixes for the 21.1.0, 17.5.0 and 17.1.0 trains and offered an iRule mitigation through support.

Who is affected

BIG-IP systems running APM 21.1.0, 17.5.x or 17.1.x where an APM access policy and an OAuth authorization server profile are configured on the same virtual server (Appliance mode included). APM used only as an OAuth client or resource server is not affected.

CVE-2026-94127. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/f5-cve-2026-94127/

Affected products

  • BIG-IP APM
How we built this timeline

F5's K000162605 is JavaScript-only (Salesforce) and Wayback captures contain no article text, so vendor facts come from the CVE record F5 published as CNA and from Rapid7, the Canadian Cyber Centre, Security Affairs and The Hacker News. Fixes are engineering (ENG) hotfixes; status 'patched' assumes those count as fixes for all three affected trains.

KEV notes tell agencies to apply the iRule for forensic triage and then 'install the final vendor patch'; whether a later non-ENG maintenance release exists was not checked. CVSS: F5 v3.1 9.8, v4.0 9.3.

CWE-122 heap-based buffer overflow (KEV).

Related

F5 report card