F5 BIG-IP Access Policy Manager (APM)

watchTowr Labs published a patch-diff analysis of CVE-2026-94127 on 2026-09-23 that makes the trigger public. The fix adds a size check before an Authorization header is copied into a heap buffer allocated at 0x4100 bytes on the OAuth UserInfo path; before the patch there was no check, so a longer header overflows the buffer (watchTowr Labs, 2026-09-23). In watchTowr's lab a single GET request to the OAuth userinfo endpoint, carrying a Bearer Authorization header larger than 0x4100 bytes, crashed the traffic-management process (watchTowr Labs, 2026-09-23). watchTowr found that the process binary is not position-independent and that an object holding a function pointer usually landed just past the overflowed buffer in its runs, which lets the overflow redirect execution; SELinux blocked direct process execution, so it turned to the hook script the appliance runs each time the traffic-management process crashes and appended a command to it (watchTowr Labs, 2026-09-23). The request-side signal to add to the authentication-log signals above is therefore an Authorization header far larger than a normal Bearer token sent to the OAuth UserInfo path, followed by a crash and restart of the traffic-management process.