Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-94127

CVE-2026-94127CRITICAL

F5 BIG-IP — BIG-IP APM OAuth vulnerability

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0223   82.1   YES

AFFECTED
  Product  Versions  Fixed
  BIG-IP   21.1.0 –  —

TIMELINE
  Sep 20  Reserved by f5
  Sep 22  ADDED TO KEV — CVE-2026-94127 (F5 BIG-IP). Remediation due September 25, 2026.
  Sep 22  Published (CNA: f5)
  Sep 26  DUE DATE PASSED — CVE-2026-94127 (F5 BIG-IP). CISA remediation deadline was September 25, 2026; still in catalog.

CWE-122 · CNA: f5 · CVSS v4.0 · 2 references · NVD status: Analyzed · KEV due September 25, 2026

Description

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
September 20, 2026	Reserved	Reserved by f5
September 22, 2026	KEV ADDED	ADDED TO KEV — CVE-2026-94127 (F5 BIG-IP). Remediation due September 25, 2026.
September 22, 2026	Published	Published (CNA: f5)
September 26, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2026-94127 (F5 BIG-IP). CISA remediation deadline was September 25, 2026; still in catalog.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
F5	BIG-IP	—	21.1.0	—

Weaknesses

CWE-122

References (2)

https://my.f5.com/manage/s/article/K000162605 [Vendor Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127 [US Government Resource]

Authoritative record: CVE-2026-94127 at cve.org

Vendors: f5

Weaknesses: CWE-122

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-94127 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.