VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 10:15 UTC

CVE-2026-94127

Read full description

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.6/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 9.8: +1.47
Fresh EPSS: 26.55%: +0.13

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 23 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

https://tech-insider.org/

Press · 29 Sep 2026, 07:00 · F5 BIG-IP Zero-Day CVE-2026-94127: CVSS 9.8 Exploited - https://tech-insider.org/

shattered.io

Press · 28 Sep 2026, 07:00 · BigDiskBuster PoC Blocks Defender Updates, 0 CVE [2026] - shattered.io

Rapid7

Press · 28 Sep 2026, 07:00 · Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 - Rapid7

systemtek.co.uk

Press · 28 Sep 2026, 07:00 · Critical security vulnerability in F5 BIG-IP Access Policy Manager (CVE-2026-94127) - systemtek.co.uk

watchTowr Labs

Press · 23 Sep 2026, 23:19 · Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)

See all 23 source documents

watchTowr Labs

Press · 23 Sep 2026, 23:19 · Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)

cyberkendra.com

Press · 23 Sep 2026, 07:00 · F5 BIG-IP APM Zero-Day CVE-2026-94127 Exploited for RCE - cyberkendra.com

Help Net Security

Press · 23 Sep 2026, 07:00 · Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances - Help Net Security

Press · 23 Sep 2026, 07:00 · F5 Releases Emergency Fixes for BIG-IP APM Zero-Day Exploited in Attacks on OAuth Servers - LinkedIn

SecurityWeek

Press · 23 Sep 2026, 07:00 · Critical F5 BIG-IP Vulnerability Exploited as Zero-Day - SecurityWeek

Rapid7

Press · 23 Sep 2026, 07:00 · CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM - Rapid7

shattered.io

Press · 23 Sep 2026, 07:00 · F5 BIG-IP Zero-Day CVE-2026-94127: CVSS 9.8 RCE - shattered.io

The Hacker News

Press · 23 Sep 2026, 07:00 · F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers - The Hacker News

The Register

Press · 23 Sep 2026, 07:00 · Someone's attacking a critical 0-day RCE in F5 BIG-IP APM - The Register

watchTowr Labs

Press · 23 Sep 2026, 07:00 · Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) - watchTowr Labs

BleepingComputer

Press · 23 Sep 2026, 07:00 · F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks - BleepingComputer

SOC Prime

Press · 23 Sep 2026, 07:00 · CVE-2026-94127: Critical F5 BIG-IP APM Zero-Day Exploited for Remote Code Execution - SOC Prime

CyberSecurityNews

Press · 23 Sep 2026, 07:00 · Hackers Exploiting F5 BIG-IP OAuth Server 0-day Flaw to Gain Remote Code Execution - CyberSecurityNews

Security Affairs

Press · 23 Sep 2026, 07:00 · F5 BIG-IP APM Zero-Day Exploited in Zero-Day RCE Attacks - Security Affairs

Field Effect

Press · 22 Sep 2026, 07:00 · F5 Fixes Actively Exploited BIG-IP APM Vulnerability - Field Effect

Forkast News

Press · 22 Sep 2026, 07:00 · The OAuth Profile Is the Door: F5 BIG-IP APM’s Heap Overflow Turns a Network Security Appliance Into an Unauthenticated Entry Point - Forkast News

GBHackers News

Press · 22 Sep 2026, 07:00 · Critical F5 BIG-IP APM Flaw Actively Exploited for Remote Code Execution - GBHackers News

Recorded Future

Press · 13 Sep 2026, 07:00 · September 2026 CVE Landscape - Recorded Future

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.6 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 9.8; EPSS 26.6%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:32.659683+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

13 Sep 2026, 07:00

Added to the CISA KEV catalog

22 Sep 2026, 00:00

Published

22 Sep 2026, 14:17

Latest press mention

29 Sep 2026, 07:00

Score calculated

05 Nov 2026, 14:00