BIG-IP (Product): news timeline & CVEs

F5 BIG-IP APM Zero-Day Exploited in Zero-Day RCE Attacks

Attackers are exploiting critical F5 BIG-IP APM zero-day CVE-2026-94127 for unauthenticated remote code execution.

F5 disclosed CVE-2026-94127, a critical flaw scored CVSS 9.8 in BIG-IP Access Policy Manager, which lets an unauthenticated attacker execute arbitrary code when APM is an OAuth Authorization Server with an access policy and OAuth profile on the same virtual server. Affected releases are BIG-IP 17.1.0 through 17.1.3, 17.5.0 through 17.5.1, and 21.1.0; hotfixes are out and an iRule is only a temporary mitigation. F5 confirmed in-the-wild exploitation, and CISA added the bug to the KEV catalog with a September 25, 2026 federal deadline. The issue is data-plane only, appliance mode is vulnerable, and Shadowserver sees more than 14,700 BIG-IP APM fingerprints, not a confirmed vulnerable count.

Security Affairsupdated Sep 24, 11:14 UTC · 2d agofirst Sep 23, 18:12 UTC · 3d agoExploit / PoC in the wild 14 sources CVE-2026-94127

Someone's attacking a critical 0-day RCE in F5 BIG-IP APM

Attackers are exploiting critical F5 BIG-IP APM zero-day CVE-2026-94127; CISA added it to KEV.

The Register reports F5 patched CVE-2026-94127, a heap-based buffer overflow in BIG-IP Access Policy Manager scored 9.3 on CVSS v4.0, affecting systems configured as an OAuth Authorization Server with an access policy and OAuth profile on the same virtual server. F5 and CISA say unknown attackers are exploiting it for remote code execution, and CISA gave federal agencies until Friday to patch. The article recalls a prior highly sophisticated intrusion in which attackers stole BIG-IP source code, undisclosed vulnerability details, and some customer configuration data. It also notes Mandiant previously linked exploitation of CVE-2023-46747 to UNC5174, assessed with moderate confidence as China-based.

The Register · Securityupdated Sep 24, 11:14 UTC · 2d agofirst Sep 23, 18:09 UTC · 3d agoExploit / PoC in the wild 14 sources CVE-2026-94127

Critical F5 BIG-IP Vulnerability Exploited as Zero-Day

F5 and CISA warned of an actively exploited critical zero-day (CVE-2026-94127) in BIG-IP APM enabling unauthenticated remote code execution.

F5 and CISA have warned that a critical zero-day vulnerability in F5 BIG-IP Access Policy Manager (APM) is being actively exploited. Tracked as CVE-2026-94127 with a CVSS score of 9.8, the flaw allows unauthenticated attackers to achieve remote code execution via malicious traffic when APM is configured as an OAuth Authorization Server. F5 has released hotfixes for affected versions, and CISA has added the CVE to its KEV list, mandating federal agencies patch within three days.

SecurityWeekupdated Sep 24, 11:14 UTC · 2d agofirst Sep 23, 07:34 UTC · 4d agoExploit / PoC in the wild 14 sources CVE-2026-94127

Critical F5 BIG-IP APM Flaw Actively Exploited for Remote Code Execution

F5 says CVE-2026-94127, a critical unauthenticated BIG-IP APM RCE, is already exploited in the wild.

F5 disclosed CVE-2026-94127, a heap-based buffer overflow in BIG-IP Access Policy Manager scored CVSS 9.8 (v3.1) and 9.3 (v4.0), and said it is already exploited. Unauthenticated attackers can execute code when an APM virtual server is configured as an OAuth Authorization Server. Affected releases include 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3, with engineering hotfixes available. Indicators include repeated OAuth failures, suspicious command activity, and TMM crashes producing SIGABRT.

GBHackersupdated Sep 24, 11:14 UTC · 2d agofirst Sep 23, 04:52 UTC · 4d agoExploit / PoC in the wild 14 sources CVE-2026-94127

Hackers Exploiting F5 BIG-IP OAuth Server 0-day Flaw to Gain Remote Code Execution

Attackers are exploiting F5 BIG-IP APM OAuth zero-day CVE-2026-94127 for unauthenticated remote code execution.

F5 says attackers are exploiting CVE-2026-94127, a critical heap-based buffer overflow in BIG-IP Access Policy Manager, for unauthenticated remote code execution. The flaw affects virtual servers configured with both an APM access policy and an OAuth Authorization Server profile, scoring CVSS v3.1 9.8 and CVSS v4.0 9.3. Known vulnerable releases include 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3; engineering hotfixes and an optional iRule mitigation are available. CISA added the CVE to its Known Exploited Vulnerabilities catalog, while attacker identity and exploitation scale are not established.

Cyber Security Newsupdated Sep 24, 11:14 UTC · 2d agofirst Sep 23, 03:24 UTC · 4d agoExploit / PoC in the wild 14 sources CVE-2026-94127

F5 security advisory (AV26-949)

Canada's Cyber Centre warns F5 BIG-IP APM flaw CVE-2026-94127 is being exploited in the wild.

The Canadian Centre for Cyber Security issued advisory AV26-949 on September 22, 2026, for an F5 BIG-IP APM vulnerability. CVE-2026-94127 affects BIG-IP 21.1.0 through hotfix 21.1.0.2.0.30.22, 17.5.0 through hotfix 17.5.1.9.0.160.12, and 17.1.0 through hotfix 17.1.3.5.0.41.14. F5 reported the flaw is being exploited in the wild. Administrators are urged to review F5 article K000162605 and apply updates.

Canadian Centre for Cyber Securityupdated Sep 24, 11:14 UTC · 2d agofirst Sep 22, 15:38 UTC · 4d agoExploit / PoC in the wild 14 sources CVE-2026-94127

2026-013: Critical Vulnerability in F5 BIG-IP APM

CERT-EU says exploited F5 BIG-IP APM flaw CVE-2026-94127 allows unauthenticated remote code execution.

On 22 September 2026, CERT-EU warned that F5 BIG-IP APM vulnerability CVE-2026-94127, a CVSS 9.8 heap-based buffer overflow, allows unauthenticated remote code execution when an access policy and OAuth profile are configured on a virtual server. F5 confirmed active exploitation. Affected versions include 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0. CERT-EU urges immediate hotfixes, evidence preservation, and checks for OAuth failures followed by suspicious commands and TMM crashes.

CERT-EU Advisoriesupdated Sep 24, 11:14 UTC · 2d agofirst Sep 22, 00:00 UTC · 5d agoExploit / PoC in the wild 14 sources CVE-2026-941273· 1 read

F5 security advisory (AV26-878)

Canada's Cyber Centre relayed an F5 advisory (AV26-878) covering vulnerabilities in BIG-IP, BIG-IQ, NGINX components, and APM clients.

The Canadian Centre for Cyber Security published advisory AV26-878 noting F5 vulnerabilities affecting BIG-IP all modules prior to 17.1.3.4, 17.5.1.8, 21.0.0.3, and 21.1.0.1, plus BIG-IQ prior to 8.4.2.1, NGINX Gateway Fabric, NGINX Ingress Controller, NGINX JavaScript 9.9, and APM clients. F5 issued an out-of-band security notification (K000162872) on September 2, 2026. Administrators are encouraged to review the linked advisory and apply updates as they become available.

Canadian Centre for Cyber SecuritySep 3, 14:05 UTC · 23d agoAdvisory1

BIG-IP

Timeline8 articles

Related CVEsby mentions

Appears with