F5 CVE-2026-94127 Targeted in Active Attacks

In today’s reminder that critical network infrastructure remains vulnerable to fundamental software engineering errors, researchers have analyzed a critical heap overflow vulnerability in F5 BIG-IP appliances that the company patched on Sept. 22 and found that it is one of the simpler and easier to exploit flaws in recent memory.

This vulnerability allows for unauthenticated remote code execution and shows how a missing bounds check—a classic programming error—can compromise even the most hardened enterprise security gateway. The vulnerability (CVE-2026-94127) has been exploited in the wild and is already in the CISA KEV. 

F5 released an advisory and a fix for the bug on Sept. 22. 

The technical simplicity of the flaw is striking. The F5 BIG-IP system, which functions as an application delivery controller and sits at the network edge, allocates a fixed heap buffer to process incoming Authorization headers. Before a recent patch, the underlying code failed to validate the size of the incoming data before executing a copy operation. Essentially, the application was designed to accept a specific amount of data but didn’t include the logic to reject anything that exceeded that size. This is a classic buffer overflow primitive, the kind typically associated with legacy code from decades ago rather than modern, high-stakes security appliances.

“It is simple: before the patch, there was no size check before copying the value to the heap buffer, and now there is one. To make it even simpler: the enterprise security appliance had a security vulnerability, grounded in a primitive from 20 years ago, specifically in how it handles security credentials,” Sina Kheirkhah of watchTowr Labs wrote in an analysis of the bug.

“It is 2026, AGI is here, and we are still writing overflow 101 vulnerability analyses."

Triggering the exploit requires minimal effort. An attacker just needs to target an F5 BIG-IP appliance configured with an OAuth profile. By crafting an HTTP request directed at an OAuth-enabled endpoint, such as the userinfo interface, and attaching an Authorization header that’s larger than the limit, the attacker forces the system to copy the oversized header into the fixed-size heap buffer. This action corrupts the heap metadata, providing the foundation for controlling the execution flow.

Although modern security mitigations are intended to thwart such attacks, they proved insufficient here. The F5 appliance does implement No-Execute (NX) protections and utilizes SELinux to enforce security policies; however, these mitigations did not prevent the exploit. Because the heap layout is somewhat predictable, an attacker can reliably land an object containing a function pointer immediately after the vulnerable buffer. By overflowing the buffer, the attacker can overwrite this function pointer, allowing them to redirect program execution to their own code.

While SELinux successfully blocked the watchTowr researchers’ initial attempt to execute a direct system shell, they found a creative workaround. The researchers discovered that by utilizing a ret2plt attack, they could open an existing system file, specifically a shell script that the process routinely accesses, and append a malicious command to it. This effectively turned a standard heap corruption into a functional RCE, demonstrating that even with modern hardening in place, the core vulnerability remains trivial to weaponize. The fix, as one would expect, is equally simple: the addition of a conditional check to ensure the header size does not exceed the allocated buffer before copying occurs.

“It is 2026, AGI is here, and we are still writing overflow 101 vulnerability analyses,” Kheirkhah said.