2026-013: Critical Vulnerability in F5 BIG-IP APM

CERT-EU warns of CVE-2026-94127, a critical (CVSS 9.8) heap-based buffer overflow in F5 BIG-IP APM that allows unauthenticated remote code execution and has been observed exploited in the wild; affected versions (when configured with an access policy and OAuth profile) include 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0. The advisory urges immediate patching or deployment of an iRule mitigation, preservation of forensic evidence, and checks for indicators such as repeated OAuth authentication failures, increases in oauth failure stats, suspicious audit log commands, and TMM core files.