Someone's attacking a critical 0-day RCE in F5 BIG-IP APM
Attackers are exploiting critical F5 BIG-IP APM zero-day CVE-2026-94127; CISA added it to KEV.
The Register reports F5 patched CVE-2026-94127, a heap-based buffer overflow in BIG-IP Access Policy Manager scored 9.3 on CVSS v4.0, affecting systems configured as an OAuth Authorization Server with an access policy and OAuth profile on the same virtual server. F5 and CISA say unknown attackers are exploiting it for remote code execution, and CISA gave federal agencies until Friday to patch. The article recalls a prior highly sophisticated intrusion in which attackers stole BIG-IP source code, undisclosed vulnerability details, and some customer configuration data. It also notes Mandiant previously linked exploitation of CVE-2023-46747 to UNC5174, assessed with moderate confidence as China-based.
- Heap overflow CVE-2026-94127 is scored CVSS 9.3 and is being exploited.
- CISA put it on KEV and gave federal agencies a Friday patch deadline.
- A prior F5 intrusion exposed source code and undisclosed flaw details.
- Mandiant linked older CVE-2023-46747 exploitation to China-nexus UNC5174.
- Vendors
- F5
- Products
- BIG-IPBIG-IP APM
- Threat actors
- UNC5174
- Organizations
- CISAMandiantGoogleU.S. Department of Justice
- Countries
- United StatesChinaUnited Kingdom
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-46747 | F5 BIG-IP TMUI Authentication Bypass Enables Unauthenticated RCE | 9.8 | 97% | KEVRansomwarePoC ×2 | KEV |
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
From the original article
1 min read at theregister.comGood news: there's a patch. Bad news: both CISA and F5 warn that it's under active exploitation
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.