Critical F5 BIG-IP Vulnerability Exploited as Zero-Day
F5 and CISA warned of an actively exploited critical zero-day (CVE-2026-94127) in BIG-IP APM enabling unauthenticated remote code execution.
F5 and CISA have warned that a critical zero-day vulnerability in F5 BIG-IP Access Policy Manager (APM) is being actively exploited. Tracked as CVE-2026-94127 with a CVSS score of 9.8, the flaw allows unauthenticated attackers to achieve remote code execution via malicious traffic when APM is configured as an OAuth Authorization Server. F5 has released hotfixes for affected versions, and CISA has added the CVE to its KEV list, mandating federal agencies patch within three days.
- F5 disclosed a critical zero-day vulnerability (CVE-2026-94127) in BIG-IP APM.
- The flaw allows unauthenticated remote code execution with a CVSS score of 9.8.
- CISA added the CVE to its Known Exploited Vulnerabilities (KEV) list.
- Exploitation requires a specific configuration: BIG-IP APM as an OAuth Authorization Server.
- CVEs
- CVE-2026-94127
- Vendors
- F5
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
From the original article
1 min read at securityweek.com
Unauthenticated attackers could send malicious traffic to BIG-IP to achieve remote code execution. The post Critical F5 BIG-IP Vulnerability Exploited as Zero-Day appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.