{"id":"CVE-2026-94127","kind":"vulnerability","aliases":["CVE-2026-94127"],"related":[],"title":"f5 big-ip access policy manager: When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic…","description":"WAF Release - 2026-10-06 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nOctober 6, 2026\n\n## WAF Release - 2026-10-06\n\nThis release introduces a new detection to mitigate a heap-based buffer overflow vulnerability in F5 BIG-IP, and enhances existing command injection protections by incorporating tested beta logic into the baseline rule.\n\nKey Findings\n\n- CVE-2026-94127: A heap-based buffer overflow vulnerability in F5 BIG-IP. Attackers can exploit this flaw to execute arbitrary code on the affected system.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...a056caff | N/A | Command Injection - Generic 8 - uri - Beta | Log | Block | This rule is merged into the original rule \"Command Injection - Generic 8 - uri\" (ID: ...ee159e2e). |\n| Cloudflare Managed Ruleset | ...7206c737 | N/A | F5 BIG-IP - UnAuth Heap-Overflow - CVE:CVE-2026-94127 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...549f7356 | N/A | Next.js - Cache Poisoning - CVE:CVE-2026-94543 | Block | Block | Rule metadata description refined. Detection unchanged. |","summary":"F5 BIG-IP APM has a heap-based buffer overflow that occurs when an access policy and an OAuth profile are configured on a virtual server. An unauthenticated remote attacker can exploit it to run code on the device, and CISA lists it as known exploited.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-09-22T00:00:00+00:00","products":[{"name":"F5 BIG-IP APM","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 17.0.0, <= 17.1.3","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 17.5.0, <= 17.5.1","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":"= 21.1.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apm","big-ip","cloudflare","exploited","f5","infrastructure","lab-disclosure","self-hosted"],"not_affected_if":["default-config","no-oauth-profile"],"how_to_check":"Check whether any BIG-IP virtual server has both an APM access policy and an OAuth profile attached; the sources do not give a specific command.","fix":"Apply the F5 vendor mitigation or patch for CVE-2026-94127; the sources do not name the fixed version. Follow CISA BOD 26-04 guidance and discontinue use of the affected configuration if no mitigation is available.","status":"open","published_at":"2026-09-22T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T20:29:45+00:00","updated_at":"2026-10-24T17:31:20+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:29:45Z","model":"claude-haiku-5-5","output":{"fix":"Apply the F5 vendor mitigation or patch for CVE-2026-94127; the sources do not name the fixed version. Follow CISA BOD 26-04 guidance and discontinue use of the affected configuration if no mitigation is available.","summary":"F5 BIG-IP APM has a heap-based buffer overflow that occurs when an access policy and an OAuth profile are configured on a virtual server. An unauthenticated remote attacker can exploit it to run code on the device, and CISA lists it as known exploited.","category":"infrastructure","who_cares":["f5","big-ip","apm","self-hosted"],"confidence":0.7,"analyst_note":"Find F5's advisory for CVE-2026-94127 to get affected and fixed versions, the mitigation steps, and any detection guidance; the KEV entry gives no version data.","how_to_check":"Check whether any BIG-IP virtual server has both an APM access policy and an OAuth profile attached; the sources do not give a specific command.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["default-config","no-oauth-profile"],"severity_if_unknown":"critical"},"cost_usd":0.000422,"input_tokens":2232,"output_tokens":398,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-06':127C,143C '-10':126C,142C '-2026':30A,33A,182C,264C,283C '-94127':31A,34A,183C,265C '-94543':284C '2026':125C,138C,141C '549f7356':276C '6':137C '7206c737':252C '8':229C,245C 'a056caff':224C 'access':5A,14A,44A,51A,58A,91B 'action':217C,219C 'affect':207C 'apm':13A,39A,61B,79B 'arbitrari':203C 'attack':106B,196C 'base':84B,155C,187C 'baselin':177C 'beta':173C,231C 'big':3A,11A,37A,42A,49A,56A,63B,77B,162C,194C,256C 'big-ip':2A,10A,36A,41A,48A,55A,62B,76B,161C,193C,255C 'block':233C,267C,285C,286C 'buffer':85B,156C,188C 'cach':279C 'changelog':128C,129C 'cisa':117B 'cloudflar':65B,135C,221C,249C,273C 'code':112B,204C 'command':167C,226C,242C 'comment':220C 'configur':21A,98B 'cve':29A,32A,181C,262C,263C,281C,282C 'descript':215C,289C 'detect':149C,272C,291C 'devic':115B 'disclosur':71B 'ee159e2e':248C 'enhanc':165C 'execut':202C 'exist':166C 'exploit':66B,108B,122B,198C 'f5':1A,35A,40A,47A,54A,67B,75B,160C,192C,254C 'find':180C 'flaw':200C 'generic':228C,244C 'heap':83B,154C,186C,260C 'heap-bas':82B,153C,185C 'heap-overflow':259C 'host':74B 'id':211C,214C,247C 'improv':133C 'incorpor':171C 'infrastructur':68B 'inject':168C,227C,243C 'introduc':146C 'ip':4A,12A,38A,43A,50A,57A,64B,78B,163C,195C,257C 'key':179C 'known':121B 'lab':70B 'lab-disclosur':69B 'legaci':212C 'list':118B 'log':232C,266C 'logic':174C 'malici':27A 'manag':7A,222C,250C,274C 'manager':46A,53A,60A 'merg':237C 'metadata':288C 'mitig':151C 'n/a':225C,253C,277C 'new':130C,148C,218C,271C 'next.js':278C 'oauth':18A,95B 'occur':88B 'octob':136C 'origin':240C 'overflow':86B,157C,189C,261C 'poison':280C 'polici':6A,15A,92B 'policy':45A,52A,59A 'previous':216C 'profil':19A,96B 'protect':169C 'refin':290C 'releas':124C,140C,145C 'remot':105B 'rule':178C,210C,213C,235C,241C,287C 'ruleset':209C,223C,251C,275C 'run':111B 'self':73B 'self-host':72B 'server':25A,102B 'specif':26A 'system':208C 'test':172C 'traffic':28A 'unauth':258C 'unauthent':104B 'unchang':292C 'updat':131C 'uri':230C,246C 'virtual':24A,101B 'vulner':158C,190C 'waf':123C,139C","nicknames":[],"mitigations":[{"kind":"waf-rule","since":"2026-10-06","covers":"HTTP requests proxied through Cloudflare that match the F5 BIG-IP unauthenticated heap-overflow exploit (Cloudflare Managed Ruleset rule ...7206c737)","limits":"none stated","source":"https://developers.cloudflare.com/changelog/post/2026-10-06-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T17:31:20Z","confidence":0.9,"source_title":"Cloudflare: WAF Release - 2026-10-06 · Changelog","customer_action":"none stated"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-22T00:00:00+00:00","kev":{"dateAdded":"2026-09-22","dueDate":"2026-09-25","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f5sirt@f5.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-94127","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-94127","severity":null,"published_at":"2026-09-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T16:39:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-94127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94127","severity":null,"published_at":"2026-09-22T15:17:24+00:00","modified_at":"2026-09-23T14:32:07+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-10-06-waf-release/#CVE-2026-94127","url":"https://developers.cloudflare.com/changelog/post/2026-10-06-waf-release/","severity":null,"published_at":"2026-10-06T17:17:59+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:18:15+00:00","fetched_at":"2026-10-24T17:18:15+00:00","note":"Cloudflare: WAF Release - 2026-10-06 · Changelog"}],"documents":[{"id":2842,"url":"https://developers.cloudflare.com/changelog/post/2026-10-06-waf-release/","title":"Cloudflare: WAF Release - 2026-10-06 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-10-06 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nOctober 6, 2026\n\n## WAF Release - 2026-10-06\n\nThis release introduces a new detection to mitigate a heap-based buffer overflow vulnerability in F5 BIG-IP, and enhances existing command injection protections by incorporating tested beta logic into the baseline rule.\n\nKey Findings\n\n- CVE-2026-94127: A heap-based buffer overflow vulnerability in F5 BIG-IP. Attackers can exploit this flaw to execute arbitrary code on the affected system.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...a056caff | N/A | Command Injection - Generic 8 - uri - Beta | Log | Block | This rule is merged into the original rule \"Command Injection - Generic 8 - uri\" (ID: ...ee159e2e). |\n| Cloudflare Managed Ruleset | ...7206c737 | N/A | F5 BIG-IP - UnAuth Heap-Overflow - CVE:CVE-2026-94127 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...549f7356 | N/A | Next.js - Cache Poisoning - CVE:CVE-2026-94543 | Block | Block | Rule metadata description refined. Detection unchanged. |","published_at":"2026-10-06T17:17:59+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}