F5 BIG-IP APM Hotfixes Address Critical OAuth Vulnerability
Tech GuruQuick Answer
CVE-2026-94127 permits unauthenticated remote code execution when a vulnerable BIG-IP APM virtual server has an access policy and OAuth Authorization Server configuration. Client/resource-server-only deployments without authorization-server profiles are excluded. CISA lists this CVE in KEV, so response must account for exploitation and forensic triage, not only routine patch validation.
Confirm Scope And Apply The Supported Fix
What to do now: Identify affected OAuth Authorization Server virtual servers and exact BIG-IP builds, preserve evidence, and engage F5 support for the supported iRule and hotfix path. Follow CISA's applicable triage guidance before disruptive remediation, then install the permanent fix.
Last verified: 2026-09-22 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | BIG-IP APM virtual servers in the listed 21.1, 17.5 and 17.1 ranges with an access policy and OAuth Authorization Server profile. Client/resource-server-only deployments without authorization-server profiles are not affected. |
|---|---|
| Advisory | K000162605 |
| CVE | CVE-2026-94127 |
| CVE record publication | 2026-09-22 14:17:42.730 UTC |
| Recorded CVE revision (historical snapshot) | 2026-09-22 14:17:42.730 UTC |
| Affected versions | BIG-IP 21.1.0 before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, 17.5.x before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, and 17.1.x before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG, when the advisory configuration is present. |
| Fixed version | Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG as appropriate |
| CVSS base score | 9.8 (CVSS v3.1) / 9.3 (CVSS v4.0) |
| CVSS severity | Critical |
| Exploitation status | CISA KEV lists this CVE, added 2026-09-22, with forensic triage required and a due date of 2026-09-25. This is exploitation evidence at the CVE level, not proof every installation is compromised. |
What Changed
F5's CNA describes unauthenticated RCE in the data plane, not control-plane exposure; Appliance mode is also vulnerable. Unsupported End of Technical Support versions were not evaluated, so their omission is not an unaffected finding. F5 offers a mitigation iRule through support; do not invent or substitute an unverified rule.
What To Validate Now
- Inventory. Record the exact BIG-IP build, virtual server, APM policy and OAuth role. Distinguish Authorization Server profiles from client/resource-server-only configurations.
- Establish applicability. Match both the vulnerable build interval and the OAuth Authorization Server condition. Appliance mode does not exclude exposure, and unevaluated EoTS releases need vendor guidance.
- Remediate. Apply Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG as appropriate through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the intended engineering hotfix is active, test approved OAuth issuance and dependent access flows, and verify logging and availability. Keep the incident/forensic assessment separate: a successful update does not establish that the device was never compromised.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
CISA's linked forensic-triage guidance and the KEV entry call for the vendor iRule as temporary mitigation during proactive triage, followed by the final patch promptly. Obtain the rule and installation prerequisites from F5; its compatibility and forensic results were not tested here.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
