F5 BIG-IP CVE-2026-94127 RCE Exploited

Threat Intel
, , ,
1

bigip
bigip1200×630 118 KB

Last Updated: 2026-09-24T02:29:00Z

What’s Happening

A F5 advisory published 2026-09-22 details CVE-2026-94127 (CVSSv3 9.8).

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE).

It is unknown how common this configuration is as of this writing.

WatchTowr has a writeup on this vulnerability with more details.

Affected Products/Versions

The affected product is BIG-IP APM (Access Policy Manager), versions:

  • 21.1.0, patched in Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso
  • 17.5.0 - 17.5.1, patched in Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso
  • 17.1.0 - 17.1.3, patched in Hotfix-BIGIP 17.1.3.5.0.41.14-ENG.iso

Actions

Patch these systems. Look for OAuth failures in /var/log/apm with the following pattern:

<DATE> <HOST> err tmm1[30975]: 01990004:3: <PROFILE_NAME>: Request UserInfo from Source ID (null) IP <IP> failed. Error Code (invalid_token) Error Description (The access token is invalid.)
1 Like