F5 BIG-IP APM CVE-2026-94127: unauthenticated RCE, but only on OAuth Authorization Server setups — CISA deadline 25 September

If you run F5 BIG-IP APM as an OAuth Authorization Server, act today. CVE-2026-94127 reaches unauthenticated remote code execution, and CISA added it to the Known Exploited Vulnerabilities catalog on 22 September 2026. The KEV due date is 25 September 2026 — three days after listing.
That said, the affected configuration is narrow. Scope yourself first.

First, scope it: only OAuth Authorization Server setups

F5's description on NVD limits the scope explicitly.
When a BIG-IP APM access policy and an OAuth profile are both configured on a virtual server, specific malicious traffic can lead to remote code execution. The vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server.
Deployments using APM strictly as an OAuth Client or Resource Server, without OAuth authorization server profiles configured, are not affected.

So "we run BIG-IP" does not automatically mean "we are exposed". Check which configuration you actually have.
If you do match, the severity is real: F5 states the BIG-IP system in Appliance mode is also vulnerable, and that this is a data plane issue with no control plane exposure.

What to do today

• ✓Confirm whether BIG-IP APM is configured as an OAuth Authorization Server (if not, you are outside the affected scope)
• ✓If it is, check whether any virtual server has both an access policy and an OAuth profile attached
• ✓Open F5 advisory K000162605 and apply the fixed version for your branch
• ✓If you cannot patch immediately, CISA points to a vendor-supplied iRule as an interim mitigation (see below)
• ✓Treat this as a case where compromise assessment comes before patching (see "check first" below)

Affected versions

The ranges below are the ones NIST has registered on NVD as analyzed (vulnStatus: Analyzed). F5's own advisory body could not be read mechanically at the time of writing, so this article does not state the fixed version numbers. Confirm them on F5's official page.

• ▸BIG-IP Access Policy Manager 17.0.0 to 17.1.3 (inclusive)
• ▸BIG-IP Access Policy Manager 17.5.0 to 17.5.1 (inclusive)
• ▸BIG-IP Access Policy Manager 21.1.0

F5 also notes that software versions past End of Technical Support (EoTS) are not evaluated. Absence from the list above is therefore not proof of safety. If you are running an EoTS version, treat it as unassessed rather than unaffected.

Two scores are published: 9.8 and 9.3

NVD shows two scores, which is easy to misread.
CVSS v3.1 gives 9.8 CRITICAL; CVSS v4.0 gives 9.3 CRITICAL. This site standardises on v3.1, so 9.8 is the figure used here. Both land in the same CRITICAL band, so the conclusion does not change.
Neither is a NIST-assigned score — both were submitted by F5 as the CNA. No separate NIST score is published alongside them.

Check for compromise before you patch

This KEV entry carries a flag that most do not: it is marked as requiring forensic triage.
CISA's wording puts the steps in this order: apply the vendor-provided iRule as a temporary mitigation to allow for proactive forensic triage, and once that is complete, install the final vendor patch as soon as possible.

The order matters because if you have already been breached, patching first can destroy evidence or leave an attacker-established foothold in place. A patch stops further entry; it does not clean up an intrusion that already happened.
If your deployment matches the affected configuration, review logs and configuration around the upgrade, not just after it.

One more thing worth reading carefully: the known ransomware campaign use field is listed as "Unknown". That does not mean ransomware operators are not using it. It means nobody has established either way, so do not treat it as reassurance.

Three lines to forward to a colleague

• ▸If you run F5 BIG-IP APM as an OAuth Authorization Server, check CVE-2026-94127 today
• ▸It reaches unauthenticated remote code execution. The CISA due date is 25 September 2026
• ▸Assess for compromise before patching — CISA has flagged this one for forensic triage

Sources