CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM

T1Critical 85Covered by 1 source · first reported by Rapid7 at 23 Sept, 08:43 UTC

Overview On September 22, 2026, F5 published a security advisory for CVE-2026-94127, a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM). The vulnerability has a CVSS v3.1 score of 9.8. An unauthenticated attacker with network access to an affected…

security

Sources

• T1CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APMRapid723 Sept, 08:43

Vulnerabilities

• CVE-2026-94127