What happened
Organisations running F5 Networks BIG-IP systems configured with a BIG-IP APM access policy and an OAuth profile on a virtual server are being targeted by a critical vulnerability. This flaw, identified as CVE-2026-94127, allows an unauthenticated attacker to perform remote code execution (RCE) through specific malicious network traffic. The vulnerability is a data plane issue, meaning it affects the processing of network traffic without impacting the control plane. Exploitation has been confirmed to be active in the wild, with attackers able to reach vulnerable systems remotely and without any prior access or user interaction. The weakness is associated with CWE-122, related to heap-based buffer overflow, and the severity score is high at 9.8 out of 10, owing to the potential for significant system compromise.
Who is affected
The vulnerability impacts affected deployments of F5 Networks BIG-IP systems that are configured with a virtual server deploying both a BIG-IP APM access policy and an OAuth profile. Systems in Appliance mode are also vulnerable. Systems that have reached End of Technical Support (EoTS) are not yet evaluated for this vulnerability. As exploitation is active, any organisation with such configurations should consider their systems potentially compromised and susceptible to remote attacks without prior authentication or user engagement.
Recommended actions
- Ensure that network exposure is minimised by segmenting affected systems behind appropriate access controls and firewalls that restrict incoming traffic.
- Review and update network perimeter security to block direct access to vulnerable services, especially those configured with the affected profile and policy combination.
- Monitor network traffic for signs of malicious activity targeting exposed BIG-IP systems.
- Apply security patches or updates provided by F5 Networks as soon as they become available to address the vulnerability.
- Assess current configurations to identify whether the vulnerable setup exists in the environment and consider disabling or modifying affected virtual servers until mitigation measures are implemented.
Indicators of compromise
At this time, no specific indicators of compromise are supplied beyond active exploitation reports. Continuous monitoring of network traffic for abnormal activity related to impacted services is advised.
