F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability Added to CISA KEV

What's on the official record

22 September — CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities Catalog. The record describes a heap-based buffer overflow vulnerability (CWE-122) in F5 BIG-IP APM that can occur when an access policy and an OAuth profile are configured on a virtual server, and states the vulnerability could allow an unauthenticated attacker to perform remote code execution. CISA's remediation due date for federal civilian agencies is 25 September 2026, and the catalogVersion is 2026.10.21. The required action is to apply mitigations in accordance with vendor instructions, in compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk. The record names no fixed version beyond two hotfixes: versions before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG and Hotfix-BIGIP-17.5.1.9.0.160.12-ENG are affected, so the first fixed versions are those two hotfixes. FIRST's EPSS model estimates a 0.022 probability of exploitation (83rd percentile as of 2026-10-23). CISA's ADP records SSVC of exploitation active, automatable yes, impact total. The catalog does not record known ransomware use.

Assessment

For a platform or AI-stack owner, the record names two first-fixed hotfixes, so the check is whether any F5 BIG-IP APM virtual server with an access policy and an OAuth profile is at or above Hotfix-BIGIP-21.1.0.2.0.30.22-ENG or Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, and to pull or patch instances still below them. CISA lists the required action as applying mitigations per vendor instructions under BOD 26-04.

For a cyber underwriter, the record provides two named first-fixed hotfixes and a CISA ADP note of active exploitation, which lets the underwriter require evidence that a policyholder's affected BIG-IP APM estate is on one of those hotfixes or otherwise mitigated before binding or pricing coverage on that control. The catalog records no known ransomware use, so coverage can be conditioned on the patch control rather than on a ransomware posture.

What would change this call

A later catalogVersion that revises the due date, the affected versions, or the ransomware field would change the record. A vendor or CISA statement naming a different fixed version would revise the patch instruction. New exploitation context, such as a campaign attribution, would move the assessment beyond what the catalog currently records.

What to check next

Confidence

Filed 25 October 2026 from the record dated 22 September 2026. The record is the CISA Known Exploited Vulnerabilities Catalog entry at catalogVersion 2026.10.21, corroborated by the CVE record and the NVD entry, each an authoritative primary source for its own fields.

Sources

[1] F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-94127

[2] CVE record CVE-2026-94127 — https://www.cve.org/CVERecord?id=CVE-2026-94127

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog