F5 BIG-IP APM Zero-Day Exploited in Zero-Day RCE Attacks
Attackers are exploiting critical F5 BIG-IP APM zero-day CVE-2026-94127 for unauthenticated remote code execution.
F5 disclosed CVE-2026-94127, a critical flaw scored CVSS 9.8 in BIG-IP Access Policy Manager, which lets an unauthenticated attacker execute arbitrary code when APM is an OAuth Authorization Server with an access policy and OAuth profile on the same virtual server. Affected releases are BIG-IP 17.1.0 through 17.1.3, 17.5.0 through 17.5.1, and 21.1.0; hotfixes are out and an iRule is only a temporary mitigation. F5 confirmed in-the-wild exploitation, and CISA added the bug to the KEV catalog with a September 25, 2026 federal deadline. The issue is data-plane only, appliance mode is vulnerable, and Shadowserver sees more than 14,700 BIG-IP APM fingerprints, not a confirmed vulnerable count.
- CVE-2026-94127 scores 9.8 and allows unauthenticated remote code execution.
- Affects APM only when configured as an OAuth Authorization Server.
- Vulnerable branches: 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0.
- CISA added it to KEV; federal deadline is September 25, 2026.
- Shadowserver tracks over 14,700 BIG-IP APM IP fingerprints.
- CVEs
- CVE-2026-94127
- Vendors
- F5
- Products
- BIG-IPBIG-IP APM
- Organizations
- CISAShadowserver
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
From the original article
2 min read at securityaffairs.com
F5 warns of a critical BIG-IP APM zero-day, CVE-2026-94127, allowing remote code execution. Attackers are already exploiting it. F5 has released emergency security updates for a critical vulnerability, tracked as CVE-2026-94127 (CVSS score of 9.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.