Hackers Exploiting F5 BIG-IP OAuth Server 0-day Flaw to Gain Remote Code Execution
Attackers are exploiting F5 BIG-IP APM OAuth zero-day CVE-2026-94127 for unauthenticated remote code execution.
F5 says attackers are exploiting CVE-2026-94127, a critical heap-based buffer overflow in BIG-IP Access Policy Manager, for unauthenticated remote code execution. The flaw affects virtual servers configured with both an APM access policy and an OAuth Authorization Server profile, scoring CVSS v3.1 9.8 and CVSS v4.0 9.3. Known vulnerable releases include 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3; engineering hotfixes and an optional iRule mitigation are available. CISA added the CVE to its Known Exploited Vulnerabilities catalog, while attacker identity and exploitation scale are not established.
- Unauthenticated heap overflow enables remote code execution on affected virtual servers
- Only APM deployments acting as an OAuth Authorization Server are vulnerable
- Engineering hotfixes cover the 21.1, 17.5, and 17.1 branches
- CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities catalog
- Attacker identity, scale, and post-compromise objectives remain unconfirmed
- CVEs
- CVE-2026-94127
- Vendors
- F5
- Products
- BIG-IPBIG-IP APM
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
From the original article
3 min read at cybersecuritynews.com
F5 has warned that hackers are actively exploiting a critical zero-day vulnerability in BIG-IP Access Policy Manager (APM) deployments to execute code remotely without authentication. Tracked as CVE-2026-94127, the flaw affects virtual servers configured with both an APM access policy and an OAuth profile, specifically where APM operates as an OAuth Authorization Server. F5 published […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.