F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

F5 BIG-IP APM contains a heap-based buffer overflow vulnerability that is triggered when an access policy and an OAuth profile are configured on a virtual server. An unauthenticated remote attacker can exploit this vulnerability to achieve remote code execution. CISA has flagged this vulnerability under BOD 26-04 for prioritized remediation. As a temporary mitigation, administrators are advised to apply the vendor-provided iRule to enable proactive forensic triage. The final remediation requires installing the official vendor patch as soon as possible. Additional forensic triage requirements are outlined in CISA's BOD 26-04 implementation guidance. The vulnerability is tracked as CVE-2026-94127 and details are available via NVD and F5's support portal.