F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks
F5 patched actively exploited BIG-IP APM zero-day CVE-2026-94127 enabling remote code execution; CISA added it to KEV with a federal patch deadline.
F5 released updates for critical BIG-IP APM zero-day CVE-2026-94127, which is exploited in remote code execution attacks against instances configured as an OAuth Authorization Server. CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by Friday. Shadowserver tracks over 14,700 internet-exposed BIG-IP APM IPs, and admins unable to patch immediately can apply an F5-provided iRule mitigation. F5 advises checking for multiple OAuth authentication failures followed by suspicious commands and a TMM SIGABRT as indicators of compromise.
- Zero-day CVE-2026-94127 exploited in RCE attacks on BIG-IP APM OAuth Authorization Server setups
- CISA added the flaw to KEV and set a federal patch deadline for Friday
- Over 14,700 BIG-IP APM instances exposed online per Shadowserver
- Mitigation iRule available for admins who cannot patch immediately
- CVEs
- CVE-2026-94127
- Organizations
- F5CISAShadowserver
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
From the original article
2 min read at bleepingcomputer.com
F5 has released security updates to address a critical BIG-IP APM zero-day vulnerability being exploited in remote code execution attacks. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.