Skip to content
OpenAdvisories
Critical · 9.8 Known exploited Public exploit CVE-2026-94127 EUVD-2026-84427GHSA-qppv-6jrg-hxq4

BIG-IP APM OAuth vulnerability

Published Sep 22, 2026 · Updated Sep 23, 2026 · Assigned by f5

Vendor: F5 Product: BIG-IP Category: Network devices

Description

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.

Impact:
This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

VendorProductAffectedFixed
F5 BIG-IP 21.1.0 – < Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, 17.5.0 – < Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, 17.1.0 – < Hotfix-BIGIP-17.1.3.5.0.41.14-ENG Hotfix-BIGIP-21.1.0.2.0.30.22-ENG

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 2

References