BIG-IP APM unauthenticated RCE exploited in the wild (CVE-2026-94127)

Actively exploited in the wild - CVE-2026-94127 is a critical unauthenticated remote code execution flaw in BIG-IP APM virtual servers that have both an access policy and an OAuth profile configured, letting network attackers run arbitrary code on the appliance. Affected systems in Appliance mode are also exposed, and no control plane access is required.

Overview

CVE-2026-94127 is a data plane vulnerability in F5 BIG-IP Access Policy Manager (APM). It triggers when a virtual server is configured with both an APM access policy and an OAuth profile, a common setup for organizations that federate identity through BIG-IP. In that state, specific malicious traffic reaching the virtual server can achieve remote code execution without any authentication, user interaction, or elevated privileges. The CVSS score is 9.8, and the vector reflects a network-facing, low complexity attack.

The exposure is limited to the data plane. There is no control plane exposure, so the management interface itself is not the entry point. However, BIG-IP systems running in Appliance mode are still vulnerable, which removes the assumption that hardened deployments are insulated.

Impact

A successful exploit grants an unauthenticated attacker remote code execution on the BIG-IP system. From there, an attacker can execute commands, pivot into internal networks reachable from the appliance, and potentially tamper with traffic the device is handling. Because BIG-IP frequently sits at the edge as a reverse proxy, load balancer, or authentication gateway, a compromised instance can expose downstream applications and credentials. This vulnerability is confirmed as actively exploited, so exposure should be treated as urgent rather than theoretical.

Remediation and Mitigation

• Identify every virtual server that has both an APM access policy and an OAuth profile configured. These are the only configurations exposed to this issue.
• Where the combination is not strictly required, remove or disable either the access policy or the OAuth profile to eliminate the attack surface while you plan a patch.
• Apply the fixed BIG-IP release from F5 as soon as it is available for your branch. Track F5’s security advisory for the exact version mapping.
• Note that software versions which have reached End of Technical Support are not evaluated and will not receive a fix. Plan an upgrade off EoTS branches.
• Restrict network access to affected virtual servers where operationally possible, and monitor for unusual process activity or outbound connections from the appliance.

Given confirmed exploitation, defenders should also review breach reports and security news for indicators tied to this campaign.

Security Insight

F5 has now joined the growing list of edge and identity vendors whose authentication gateways have become initial access targets, echoing the playbook seen with VPN and remote access appliances over the past several years. The trigger here is a feature combination rather than a single misconfiguration, which means many organizations may be vulnerable without realizing their OAuth and APM settings overlap. Organizations that inventory configuration dependencies, not just software versions, will respond to the next edge-device CVE far faster.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs