A BIG-IP flaw scored 9.8 needs two features switched on to reach you
Serguey Asael Shinder2 min readF5 published an advisory on 22 September 2026 for CVE-2026-94127, a heap-based buffer overflow in BIG-IP Access Policy Manager carrying a CVSS v3.1 score of 9.8. An unauthenticated attacker with network access to an affected virtual server may reach remote code execution by sending crafted traffic.
The exposure condition is narrow and it is the part to read first. The flaw is not reachable in a default configuration: it requires a virtual server with both an APM access policy and an OAuth profile configured together. It affects the data plane only and does not expose the control plane. Appliance mode is affected as well.
Fixed hotfixes, by release train:
- BIG-IP 21.1.0 —
Hotfix-BIGIP-21.1.0.2.0.30.22-ENGor later - BIG-IP 17.5.0 —
Hotfix-BIGIP-17.5.1.9.0.160.12-ENGor later - BIG-IP 17.1.0 —
Hotfix-BIGIP-17.1.3.5.0.41.14-ENGor later
CVE-2026-94127 was added to the CISA Known Exploited Vulnerabilities catalogue on 22 September, the same day, while Rapid7 records that a publicly available proof of concept was not confirmed. Where the hotfix cannot be applied immediately, F5 offers an iRule workaround through a support case rather than publishing it.
What it means
The two-condition requirement is not a reason to relax, it is the thing that decides your morning. Before patching, find out which virtual servers carry an access policy and an OAuth profile at the same time — that list is the exposure, and it is usually much shorter than the inventory of BIG-IP devices. A fleet-wide patch schedule that cannot answer that question will spend its urgency evenly across machines that are not reachable.
The KEV listing on the day of publication is the unusual signal here. KEV is a statement about exploitation, not about severity, and a 9.8 alone would not put an entry there. Read alongside "no public PoC confirmed", it says someone was already using this before the advisory existed.
And the placement matters more than the score. APM sits at the network edge doing identity-aware access control, integrating OAuth, OpenID Connect and SAML — it is the thing in front of the applications. A data-plane RCE there is pre-authentication by construction, because authentication is what the box was going to do next.