CVE-2026-94127 · High · CISA KEV

F5 BIG-IP APM Heap Overflow: Unauthenticated RCE, CISA KEV Listed

Threat Engine Auto-Feed · data current as of 2026-09-23

A heap-based buffer overflow in F5 BIG-IP APM, when configured with an access policy and OAuth profile, allows unauthenticated remote code execution. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild. Its EPSS percentile of 71 suggests a higher-than-average likelihood of exploitation.

  • CVSS:
  • EPSS percentile: 0.71171
  • Exploitation pressure: 68/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 71th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

A heap-based buffer overflow occurs when a program attempts to write more data into a fixed-size memory buffer than it can hold, specifically in the 'heap' memory region. This can overwrite adjacent memory, leading to crashes, unpredictable behavior, or, in severe cases, allowing an attacker to execute arbitrary code on the system.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using F5 BIG-IP APM for access management, particularly those in financial services and technology sectors, due to documented adversary targeting.
  • Enterprises that have configured F5 BIG-IP APM virtual servers with both an access policy and an OAuth profile.

Misconfigurations that escalate it

  • Configuring F5 BIG-IP APM virtual servers with both an access policy and an OAuth profile simultaneously.

High-impact scenarios

  • Unauthenticated remote code execution, potentially leading to full system compromise.
  • Unauthorized access to sensitive internal resources protected by the APM.
  • Disruption of critical access management services, impacting business operations.
  • Lateral movement within the network after initial compromise of the APM device.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor F5 BIG-IP APM logs for unusual activity, crashes, or unexpected process terminations.
  • Regularly audit F5 BIG-IP APM configurations to identify virtual servers with both access policies and OAuth profiles.
  • Implement network intrusion detection systems (NIDS) to flag suspicious traffic patterns targeting F5 BIG-IP APM devices.

Contain

  • Isolate affected F5 BIG-IP APM instances from the network if compromise is suspected.
  • Review and restrict network access to F5 BIG-IP APM management interfaces.

Patch

  • Apply vendor-provided security patches for F5 BIG-IP APM immediately upon availability.
  • Consult F5 advisories for specific remediation steps and affected versions.

Frontier verdict — High

This is a critical vulnerability due to unauthenticated remote code execution, active exploitation in the wild (CISA KEV), and a high EPSS percentile, requiring immediate patching.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.