actively exploited · CISA KEV

CVE-2026-94127

NVD CRITICAL 9.8 · published 2026-09-22 · 1 on the wire

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Exploited in the wild

Yes

CISA added it 2026-09-22. An observation, not a forecast.

EPSS · 30-day forecast

Chance of exploitation in the next 30 days, 71th percentile of all CVEs. A forecast; KEV outranks it.

CVSS · NVD

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Internet exposure

—

No exposure census on this CVE's dispatches.

On the wire1

23 SepCISA adds CVE-2026-94127 (F5 BIG-IP APM) to the Known Exploited Vulnerabilities catalogEXPL

References

Early access

Watch this one?

Early access opens alerts first — one email when a CVE you follow lands on KEV or an adversary you follow lands on the wire. Nothing else, ever.

bot-protected