F5 patches actively exploited BIG-IP APM zero-day CVE-2026-94127; CISA orders federal patching by September 25

Unknown attackers are exploiting unauthenticated heap-overflow RCE CVE-2026-94127 in F5 BIG-IP APM deployments configured as OAuth Authorization Servers; F5 shipped hotfixes on September 22 and CISA added the flaw to its KEV catalog with a September 25, 2026…

F5 advisory K000162605 (published September 22, 2026) discloses CVE-2026-94127, an unauthenticated heap-based buffer overflow in BIG-IP Access Policy Manager that enables pre-auth remote code execution. The flaw affects APM only when configured as an OAuth Authorization Server with an access policy and OAuth profile on the same virtual server; it is data-plane only, appliance mode is vulnerable, and other BIG-IP modules and BIG-IQ are not affected. Sources disagree on severity: The Register reports CVSS 9.3 (v4.0), while Security Affairs and CSO Online report 9.8. Affected releases are BIG-IP 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0, with hotfix ISOs shipping for the 17.1.3, 17.5.1, and 21.1.0 branches and an iRule available only as interim mitigation. watchTowr's patch-diff of BIG-IP 21.1.0 against the fixed hotfix (1,728 functions compared via IDA and Diaphora) found the fix adds a size check rejecting Authorization headers larger than 0x4100 bytes, the overflow trigger being an oversized Authorization header against a 0x4100-byte heap buffer. F5 and CISA confirm active in-the-wild exploitation; CISA added the bug to the KEV catalog on Tuesday (September 23) with a September 25, 2026 federal patching deadline. F5 advises reviewing logs for exploitation indicators: repeated OAuth authentication failures, suspicious commands, and TMM SIGABRT crashes. Exposure figures also differ: Security Affairs cites Shadowserver tracking more than 14,700 BIG-IP APM IP fingerprints (not a confirmed vulnerable count), while CSO Online cites more than 15,000 internet-exposed BIG-IP APM deployments. Context: The Register recalls a prior highly sophisticated F5 intrusion in which attackers stole BIG-IP source code, undisclosed vulnerability details, and some customer configuration data, and notes Mandiant previously linked exploitation of CVE-2023-46747 to UNC5174, assessed with moderate confidence as China-based.