F5 BIG-IP APM flaw now patched amid reported active exploitation

OAuth authorization-server configuration defines the affected scope

The Register reported that F5 fixed CVE-2026-94127, a critical heap-based buffer-overflow vulnerability in BIG-IP APM. The flaw affects systems configured as an OAuth Authorization Server with an access policy and OAuth profile on the same virtual server. According to the report, F5 said it had learned the vulnerability was exploited, and CISA added it to its Known Exploited Vulnerabilities catalog with a patching deadline for US federal agencies.

The report does not establish the prior exploitation status of affected BIG-IP APM systems.

F5 has issued a fix for CVE-2026-94127, while F5 and CISA reportedly warn that the flaw is being actively exploited.

BIG-IP APM provides centralized access to enterprise networks, applications, APIs, and cloud services. The reported combination of a critical remote-code-execution flaw, a patch, and an active-exploitation warning makes configuration-specific remediation consequential for operators.