Our automated tracking framework flagged that CISA added CVE-2026-94127 (F5 BIG-IP APM) to the Known Exploited Vulnerabilities (KEV) catalog on September 27, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-94127 by September 25, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-94127 |
| Vendor / product | F5 BIG-IP APM |
| Vulnerability | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability |
| CVSS base score | 9.8 |
| Added to KEV | September 22, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | September 25, 2026 |
| Known ransomware use | No |
How This Compares to F5’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published.
| F5 in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 8 |
| Median lag (public → KEV listing) | 84 days |
| 0-day rate (exploited at or before disclosure) | 13% |
| Entries tied to known ransomware campaigns | 4 |
For perspective, the median across all 1726 tracked KEV entries is 246 days — F5’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent F5 KEV Additions
The most recent F5 vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2025-53521 | BIG-IP | March 27, 2026 | 163 | No |
| CVE-2023-46747 | BIG-IP Configuration Utility | October 31, 2023 | 5 | ⚠️ Yes |
| CVE-2023-46748 | BIG-IP Configuration Utility | October 31, 2023 | 5 | No |
| CVE-2022-1388 | BIG-IP | May 10, 2022 | 5 | ⚠️ Yes |
| CVE-2021-22991 | BIG-IP Traffic Management Microkernel | January 18, 2022 | 293 | No |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-94127, a heap-based buffer overflow vulnerability in F5 BIG-IP APM, to its Known Exploited Vulnerabilities (KEV) catalog. With a CVSS base score of 9.8, this critical vulnerability requires immediate attention from security teams, especially those utilizing F5 BIG-IP APM devices. The federal deadline for patching is September 25, 2026, just three days after its KEV listing. This rapid turnaround shows the urgency of the threat.
CVE-2026-94127 was added to the KEV catalog on the same day it became public, signaling active, in-the-wild exploitation. Organizations with internet-facing F5 BIG-IP APM instances are highly exposed and must apply the patch before September 25, 2026. If you can’t patch by the deadline, restrict access to affected systems by isolating them, applying strict network segmentation, and enhancing monitoring for suspicious activity originating from or targeting F5 BIG-IP APM devices. Review logs and network traffic for signs of compromise.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
