CVE-2026-94127

Vendor

F5

Product

BIG-IP APM

CVSS

9.8

CISA KEV

added 22 Sep 2026, due 25 Sep 2026 (37d overdue)

Weakness

CWE-122

Exposure class

Edge / VPN / firewall

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 87
   KEV NVD 22 Sep 2026

   F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

   F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code…

   KEV · due 25 Sep 2026 (overdue) CVSS 9.8 Fix available CVE-2026-94127 F5
2. 65
   CISA alert CISA 22 Sep 2026

   CISA Adds Four Known Exploited Vulnerabilities to Catalog

   CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability…

   Exploited CVE-2026-85102CVE-2026-93616CVE-2026-93952+1 more Arista Networks Check Point
3. 28
   watchTowr Labs watchTowr 23 Sep 2026

   Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)

   Well, well, well, well, well, well, well, well, well, well, well, well, well, well, well. We're back. Sorry. We've been watching the onslaught of vulnerabilities flood the internet. Every man, dog, and their grandmas…

   CVE-2026-94127 F5
4. 16
   Research Check Point Research 28 Sep 2026

   28th September – Threat Intelligence Report

   For the latest discoveries in cyber research for the week of 28th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The FBI has confirmed unauthorized activity affecting FBIjobs.gov after the…

   CVE-2026-85102CVE-2026-93616CVE-2026-94127+1 more