CVE-2026-94127: F5 BIG-IP APM RCE Under Active Exploitation

CVE-2026-94127 is a critical (CVSS 9.8) heap-based buffer overflow in F5 BIG-IP Access Policy Manager that permits unauthenticated remote code execution when an APM access policy and an OAuth authorization-server profile coexist on the same virtual server; F5 has released engineering hotfixes and confirmed in-the-wild exploitation, and CISA added the flaw to its KEV with a three-day federal remediation deadline. The report explains the specific configuration that creates exposure, lists affected releases and hotfix identifiers, outlines behavioral indicators (OAuth failures, TMM crashes, suspicious admin commands), and advises preserving evidence, applying the correct hotfix, using a vendor iRule only as a temporary mitigation, and performing expanded incident response if compromise is suspected.