F5 BIG-IP APM OAuth Authorization Server Remote Code Execution (RCE) Vulnerability (CVE-2026-94127)

The primary recommendation is to upgrade to a fixed software version as specified in F5 Advisory K000162605. If immediate patching is not feasible, implement the following mitigations:

• Disable OAuth Profile: Remove the OAuth Authorization Server profile from any associated Virtual Servers.
• iRules Implementation: Deploy iRules to inspect and drop suspicious OAuth-related traffic.

# Example: Rejecting excessively large Authorization headers
when HTTP_REQUEST {
    if { [HTTP::header exists "Authorization"] && [string length [HTTP::header "Authorization"]] > 4096 } {
        drop
    }
}

• Monitor Logs: Closely monitor APM logs for unusual segmentation faults or repeated crashes in the TMM (Traffic Management Microkernel) process.

CVE-2026-94127 is a critical heap-based buffer overflow vulnerability (CWE-122) residing in the OAuth processing engine of F5 BIG-IP APM. The flaw manifests when the APM is acting as an OAuth Authorization Server, where insufficient validation of incoming request payloads allows for memory corruption. Since this issue exists in the data plane, it can be exploited remotely without prior authentication. The inclusion of this CVE in the CISA KEV catalog and its high EPSS score (0.94) underscore that this vulnerability is being actively exploited in the wild, posing a severe risk to enterprise network perimeters.