F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers
F5 patches actively exploited critical zero-day (CVE-2026-94127) in BIG-IP APM OAuth servers, enabling unauthenticated remote code execution.
F5 has patched a critical zero-day vulnerability (CVE-2026-94127) in its BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution. The flaw, a heap-based buffer overflow rated 9.8 on CVSS v3.1, is actively being exploited in the wild. It affects only BIG-IP systems configured to use APM as an OAuth authorization server. CISA has added the CVE to its Known Exploited Vulnerabilities catalog and mandated federal agencies apply mitigations by September 25.
- Attackers are actively exploiting a critical zero-day in F5 BIG-IP APM for unauthenticated remote code execution.
- The flaw (CVE-2026-94127) affects systems where APM serves as an OAuth authorization server.
- CISA has added the CVE to its KEV catalog, ordering federal agencies to apply mitigations by September 25.
- F5 has released engineering hotfixes, and an iRule mitigation is available as an interim fix.
- The vulnerability is a heap-based buffer overflow, rated 9.8/10 on CVSS v3.1.
- CVEs
- CVE-2026-94127
- Vendors
- F5
- Countries
- United StatesEuropean Union
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
From the original article
3 min read at thehackernews.com
Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.