Firetruck

CVE-2026-94127

KEV
Updated Sep 23, 2026 · PUBLISHED
View KEV entry →

Description

F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.

Full record on cve.org →

Affected packages

PackageVendor / ProductVersion rangeStatus
BIG-IPF5 / BIG-IP>= 17.1.0, < Hotfix-BIGIP-17.1.3.5.0.41.14-ENGaffected
BIG-IPF5 / BIG-IP>= 17.5.0, < Hotfix-BIGIP-17.5.1.9.0.160.12-ENGaffected
BIG-IPF5 / BIG-IP>= 21.1.0, < Hotfix-BIGIP-21.1.0.2.0.30.22-ENGaffected