---
title: F5 Reveals Critical Heap Buffer Overflow in BIG-IP APM
url: https://www.dataloco.com/en/f5-reveals-critical-heap-buffer-overflow-in-big-ip-apm
published: 2026-09-25T15:21:47+00:00
language: en
section: Security
source: https://www.security-next.com/190576
organizations: F5, BIG-IP, APM, CVE-2026-94127
publisher: Dataloco
---

# F5 Reveals Critical Heap Buffer Overflow in BIG-IP APM

F5 disclosed a critical vulnerability in its BIG-IP Access Policy Manager that allows arbitrary code execution when malicious traffic exploits a heap buffer overflow. The flaw, tracked as CVE-2026-94127, affects virtual servers configured with access policies and OAuth profiles, and can be triggered by crafted traffic.

The vulnerability also impacts appliance mode and carries a CVSSv4.0 base score of 9.3 and a CVSSv3.1 score of 9.8, placing it at the highest severity level, critical. F5 confirmed that the issue was discovered internally and that exploitation is already occurring in the wild. The company urged customers to apply patches and monitor for signs of compromise.

Additional security updates were reported across multiple platforms, including WordPress, Microsoft Edge, Linux kernel, Synology NAS, Chrome, pgAdmin 4, and Firefox 156, reflecting a busy week for vulnerability disclosures.

## This story in other languages

- [Deutsch](https://www.dataloco.com/de/schwere-sicherheitsanfalligkeit-bei-big-ip-apm-entdeckt)
- [Français](https://www.dataloco.com/fr/vulnerabilite-critique-dans-big-ip-apm-confirmee)
- [Türkçe](https://www.dataloco.com/tr/f5-big-ip-apm-urununde-kritik-guvenlik-acigi-tespit-edildi)
- [Русский](https://www.dataloco.com/ru/obnaruzena-uiazvimost-v-big-ip-apm-uze-zafiksirovano-zloupotreblenie)
- [हिन्दी](https://www.dataloco.com/hi/f5-ka-big-ip-apm-ma-gabhara-sarakashha-samasaya-pahal-sa-ha-tharapayaga-ha-caka-ha)
- [Polski](https://www.dataloco.com/pl/wykryto-powazna-luke-w-systemie-big-ip-apm)
- [العربية](https://www.dataloco.com/ar/thghr-amny-khtyr-fy-big-ip-apm)
- [Português (Brasil)](https://www.dataloco.com/pt-br/vulnerabilidade-critica-encontrada-no-big-ip-apm-da-f5)