CVE-2026-94127: Critical F5 BIG-IP APM Zero-Day Exploited for Remote Code Execution

F5 disclosed CVE-2026-94127, a critical heap-based buffer overflow in BIG-IP APM’s OAuth Authorization Server functionality that allows unauthenticated remote code execution when an APM access policy and OAuth profile are configured on the same virtual server; the flaw (CVSS 9.8 v3.1, 9.3 v4.0) is being actively exploited and was added to CISA’s KEV with an urgent remediation deadline. F5 published engineering hotfixes for affected release branches and offers a vendor-provided iRule as a temporary mitigation; the advisory includes detection guidance (repeated OAuth failures in /var/log/apm, TMM crashes/SIGABRT, suspicious audit commands, increased oauth failure stats) and recommends preserving forensic evidence and investigating any systems reachable from vulnerable virtual servers.