F5 BIG-IP APM OAuth Authorization Server Heap Overflow Leading to Unauthenticated RCE

F5 disclosed CVE-2026-94127, a critical (CVSS v3.1 9.8 / v4.0 9.3) heap-based buffer overflow in BIG-IP Access Policy Manager when used as an OAuth Authorization Server that permits unauthenticated remote code execution and has been observed exploited in the wild; CISA added it to the KEV catalog with an urgent remediation deadline. F5 provides hotfixes and an iRule mitigation, and the report supplies IOCs and hunting guidance (repeated OAuth failures, suspicious commands, and TMM SIGABRT/core files) and advises preserving forensic evidence and treating reachable, unpatched instances as credible compromises.