AL26-022 - Vulnerability impacting F5 BIG-IP Access Policy Manager (APM) – CVE-2026-94127

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Canadian Centre for Cyber Security (Cyber Centre) is aware of a critical vulnerability affecting F5 BIG IP Access Policy Manager (APM)Footnote 1.

In response to the vendor advisory released on September 22, 2026, the Cyber Centre released AV26-949 on September 22, 2026Footnote 2.

Tracked as CVE-2026-94127Footnote 3, this vulnerability is a Heap-based Buffer Overflow (CWE-122)Footnote 4 and it affects F5 BIG-IP systems where an APM access policy and an OAuth profile are configured on the same virtual server. Under these conditions, specially crafted malicious traffic may allow an unauthenticated attacker to execute arbitrary code on the affected device, potentially resulting in remote code execution and full system compromise.

F5 has indicated that CVE-2026-94127 is being exploited in the wild.

Suggested actions

The Cyber Centre strongly recommends that organizations running affected F5 BIG‑IP APM deployments upgrade to the following vendor-supported fixed hotfix releases:

Affected product	Affected versions	Fixed Versions
BIG IP APM	Versions 17.1.0 prior to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG	Version 17.1.0 Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
BIG IP APM	Versions 17.5.0 prior to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG	Version 17.5.0 Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
BIG IP APM	Versions 21.1.0 prior to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG	Version 21.1.0 Hotfix-BIGIP-21.1.0.2.0.30.22-ENG

The Cyber Centre also recommends organizations to:

• Identify vulnerable BIG IP systems that have both an APM access policy and an OAuth profile configured on a virtual server.
• Apply the vendor-provided iRule (contact F5 Support to obtain the iRule)Footnote 1.
• Review access logs for indicators of compromise (IoC), particularly OAuth authentication failures especially in rapid succession or large volumeFootnote 1. Also review administrative accounts, access policies for any signs of suspicious activity.
• Upgrade to a vendor-supported fixed software version as soon as possible.
• Ensure management interfaces are restricted to trusted administrative networks.
• Follow F5 guidance for vulnerability remediation and validation following patch deployment.

Note: Organizations operating Common CriteriaFootnote 5 evaluated configurations should review F5's advisoryFootnote 1 and apply the recommended updates in accordance with their change management and certification requirements.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security ActionsFootnote 6 with an emphasis on the following topics:

• Consolidating, monitoring, and defending Internet gateways
• Patch operating systems and applications
• Harden operating systems and applications
• Isolate web-facing applications

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

References