CVE-2026-94127

Summary

This vulnerability allows unauthenticated attackers to perform remote code execution when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, leading to potential system compromise.

Exploitability

Exploitation is relatively straightforward given the specific configuration requirements, and an attacker must be able to send specific malicious traffic.

Blast radius

If exploited, this vulnerability could result in complete system compromise, including data theft and control of the BIG-IP system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable BIG-IP APM when not used as an OAuth Authorization Server, or upgrade to the latest supported version of BIG-IP APM.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.