F5 BIG-IP APM Zero-Day Exploited in Zero-Day RCE Attacks
Attackers are exploiting critical F5 BIG-IP APM zero-day CVE-2026-94127 for unauthenticated remote code execution.
88
Product
BIG-IP
- Mentions · 7d0
- Mentions · 30d0
- All mentions8
- First seenSep 3, 2026
- Last mentionedSep 23, 2026
Timeline
8 articles · newest firstSomeone's attacking a critical 0-day RCE in F5 BIG-IP APM
Attackers are exploiting critical F5 BIG-IP APM zero-day CVE-2026-94127; CISA added it to KEV.
87
Critical F5 BIG-IP Vulnerability Exploited as Zero-Day
F5 and CISA warned of an actively exploited critical zero-day (CVE-2026-94127) in BIG-IP APM enabling unauthenticated remote code execution.
95
Critical F5 BIG-IP APM Flaw Actively Exploited for Remote Code Execution
F5 says CVE-2026-94127, a critical unauthenticated BIG-IP APM RCE, is already exploited in the wild.
88
Hackers Exploiting F5 BIG-IP OAuth Server 0-day Flaw to Gain Remote Code Execution
Attackers are exploiting F5 BIG-IP APM OAuth zero-day CVE-2026-94127 for unauthenticated remote code execution.
87
F5 security advisory (AV26-949)
Canada's Cyber Centre warns F5 BIG-IP APM flaw CVE-2026-94127 is being exploited in the wild.
82
2026-013: Critical Vulnerability in F5 BIG-IP APM
CERT-EU says exploited F5 BIG-IP APM flaw CVE-2026-94127 allows unauthenticated remote code execution.
86
F5 security advisory (AV26-878)
Canada's Cyber Centre relayed an F5 advisory (AV26-878) covering vulnerabilities in BIG-IP, BIG-IQ, NGINX components, and APM clients.
28
Related CVEs
by mentions- CVE-2026-9412727%9.3Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile
- CVE-2023-4674797%9.8F5 BIG-IP TMUI Authentication Bypass Enables Unauthenticated RCE
Appears with
- F5vendor · 8
- BIG-IP APMproduct · 6
- CISAorganization · 4
- F5organization · 3
- Canadian Centre for Cyber Securityorganization · 2
- Shadowserverorganization · 1
- Googleorganization · 1
- UNC5174threat actor · 1
- U.S. Department of Justiceorganization · 1
- CERT-EUorganization · 1
- Access Policy Manager (APM)product · 1
- NGINX Ingress Controllerproduct · 1
- BIG-IQproduct · 1
- Mandiantorganization · 1
- NGINX Gateway Fabricproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.