CVE-2026-94127
A critical security vulnerability identifier assigned to the F5 BIG-IP APM platform. Classified as a heap buffer overflow, it carries a CVSS v3.1 score of 9.8. The vulnerability affects virtual servers configured with APM access policies and OAuth authorization server profiles, enabling unauthenticated remote code execution.
Timeline (last 90 days)
CVE-2026-94127 is a heap buffer overflow vulnerability in the F5 BIG-IP platform with a CVSS v3.1 score of 9.8, rated Critical.
The F5 advisory confirms that the vulnerability has been exploited, and a notice on the same issue from New York State also indicates that F5 has confirmed the existence of in-the-wild exploitation.
The vulnerability was discovered internally by F5, falls under the vendor-originated discovery category, and had no confirmed third-party proof-of-concept (PoC) when it entered the federal catalog on September 22.
CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities (KEV) catalog on the same day it was disclosed, September 22.
All Facts (4)
CVE-2026-94127 is a heap buffer overflow vulnerability in the F5 BIG-IP platform with a CVSS v3.1 score of 9.8, rated Critical.
50%UnverifiedThe F5 advisory confirms that the vulnerability has been exploited, and a notice on the same issue from New York State also indicates that F5 has confirmed the existence of in-the-wild exploitation.
50%UnverifiedThe vulnerability was discovered internally by F5, falls under the vendor-originated discovery category, and had no confirmed third-party proof-of-concept (PoC) when it entered the federal catalog on September 22.
50%UnverifiedCISA added CVE-2026-94127 to the Known Exploited Vulnerabilities (KEV) catalog on the same day it was disclosed, September 22.
50%