Heap‑Based Buffer Overflow (CVE‑2026‑94127) in F5 BIG‑IP APM Enables Unauthenticated Remote Code Execution
What It Is – F5 BIG‑IP Access Policy Manager (APM) contains a heap‑based buffer overflow that is triggered when an access policy and an OAuth profile are configured on a virtual server. The flaw can be abused by an unauthenticated attacker to execute arbitrary code on the appliance.
Exploitability – The vulnerability is publicly disclosed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. No public proof‑of‑concept is required; the attack vector is a direct network request. CVSS is reported as 9.8 (Critical) by NVD.
Affected Products – F5 Networks BIG‑IP APM (any version that supports access policies with OAuth profiles).
Why It Matters for Trust & Control Assurance
- Patch Management & Vulnerability Monitoring – Continuous evidence that patches are applied within defined service‑level windows is a core control objective across SOC 2, ISO 27001, NIST CSF and others.
- Defensible Audit Trail – Demonstrating that the organization performed timely vulnerability scans and retained remediation records satisfies auditors looking for “reasonable assurance” of system integrity.
- Control Mapping – Mapping this CVE to the “Vulnerability Management” control area lets you show compliance across multiple frameworks with a single piece of evidence.
Recommended Actions
- Apply the F5‑released hotfix for CVE‑2026‑94127 immediately.
- Verify that no virtual servers retain the vulnerable configuration (access policy + OAuth profile).
- Update your vulnerability‑management process to flag any future BIG‑IP APM releases that modify the APM code path.
- Capture patch‑deployment logs and scan results as evidence for audit readiness.
Source: CISA KEV – CVE‑2026‑94127