CVE-2026-94127

F5 BIG-IP APM heap-based buffer overflow allows unauthenticated remote code execution when access policy and OAuth profile are configured.

An unauthenticated attacker can execute arbitrary code on F5 BIG-IP APM devices if access policy and OAuth profile are configured, enabling full system compromise. DIB organizations must patch this KEV-listed vulnerability immediately to prevent lateral movement and credential theft. This is a critical RCE flaw that bypasses standard authentication controls.

Shame score — A known heap-based buffer overflow in a widely deployed network security device allows unauthenticated remote code execution, representing a severe avoidable risk that attackers actively exploit.