CISA Adds Actively Exploited F5 BIG-IP APM Flaw to KEV Catalog

CISA has added CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP APM, to its Known Exploited Vulnerabilities catalog. The vulnerability allows unauthenticated remote code execution when an access policy and an OAuth profile are configured on the same virtual server. It was added on 2026-09-22 with a federal remediation deadline of 2026-09-25.

F5 BIG-IP APM is under active exploitation. CISA added the flaw to its Known Exploited Vulnerabilities catalog, and F5 stated it has learned the vulnerability has been exploited. It carries a CVSS v4 score of 9.3 and can be triggered by sending malicious traffic.

Affected systems require the specific combination of APM access policy and OAuth profile on one virtual server. CISA directs federal agencies to apply mitigations per vendor instructions in line with BOD 26-04. Organizations must evaluate internet exposure of each asset and either patch or discontinue use if mitigations are unavailable.

Vendor guidance and hotfixes are available. F5 has released hotfix versions such as 17.1.0 Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. The company recommends deploying an iRule as a temporary mitigation. Its advisory is tracked as K000162605.

Forensic triage is mandatory before patching. CISA directs agencies to check for indicators of compromise prior to remediation under its “Forensics Triage Requirements” for BOD 26-04. Stakeholders remain responsible for compliance even in cloud deployments.

Related Check Point vulnerability also added today. On the same date CISA added CVE-2026-85102, an improper certificate validation flaw in Check Point Security Gateway and Spark Firewall. It too could allow unauthenticated remote code execution and requires forensic triage per BOD 26-04. The dual additions underscore heightened focus on VPN and access-policy products.