Skip to content
Advisories.
f5CVE-2026-94127

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE).

Critical9.3CVE-2026-94127 · Published Sep 22, 2026 · updated Sep 23, 2026

Source advisory

Affected versions

PackageAffectedFixed in
BIG-IP
Vendor
>= 21.1.0, < Hotfix-BIGIP-21.1.0.2.0.30.22-ENGHotfix-BIGIP-21.1.0.2.0.30.22-ENG
>= 17.5.0, < Hotfix-BIGIP-17.5.1.9.0.160.12-ENGHotfix-BIGIP-17.5.1.9.0.160.12-ENG
>= 17.1.0, < Hotfix-BIGIP-17.1.3.5.0.41.14-ENGHotfix-BIGIP-17.1.3.5.0.41.14-ENG
Details and references

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
no source yet
Weakness
CWE-122

More f5 advisories

All
DateAdvisory
Sep 15NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.
CVE-2026-90439Medium6.9fixed in NGINX Plus 37.1.1.2, NGINX Plus 37.0.6.2, NGINX Open Source 1.31.6
Sep 2Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method.
CVE-2026-78689Critical9.2fixed in NGINX JavaScript 1.0.1
Sep 2When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller.
CVE-2026-77180High8.7fixed in NGINX Ingress Controller 5.6.0, NGINX Ingress Controller 2026-lts-r5
Sep 2A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText.
CVE-2026-78222High8.7fixed in NGINX JavaScript 1.0.1
Sep 2A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing...
CVE-2026-63020Low2.3fixed in BIG-IP 21.1.0.1, BIG-IP 21.0.0.3, BIG-IP 17.5.1.8
Sep 2Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric.
CVE-2026-66362High8.6fixed in NGINX Gateway Fabric 2.6.8

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.