Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

2 sources · 2 articlesFirst reported Updated ()2
Merged summary · from the lead articleSummaries by Vani AI

F5 patches actively exploited critical zero-day (CVE-2026-94127) in BIG-IP APM OAuth servers, enabling unauthenticated remote code execution.

F5 has patched a critical zero-day vulnerability (CVE-2026-94127) in its BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution. The flaw, a heap-based buffer overflow rated 9.8 on CVSS v3.1, is actively being exploited in the wild. It affects only BIG-IP systems configured to use APM as an OAuth authorization server. CISA has added the CVE to its Known Exploited Vulnerabilities catalog and mandated federal agencies apply mitigations by September 25.

Key facts
  • Attackers are actively exploiting a critical zero-day in F5 BIG-IP APM for unauthenticated remote code execution.
  • The flaw (CVE-2026-94127) affects systems where APM serves as an OAuth authorization server.
  • CISA has added the CVE to its KEV catalog, ordering federal agencies to apply mitigations by September 25.
  • F5 has released engineering hotfixes, and an iRule mitigation is available as an interim fix.
  • The vulnerability is a heap-based buffer overflow, rated 9.8/10 on CVSS v3.1.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2026-94127CVE-2025-5352CVE-2026-93616CVE-2026-85102CVE-2026-93952CVE-2023-46747
Vendors
F5Check Point SoftwareAristaF5 NetworksCheck Point
Products
F5 BIG-IPF5 BIG-IP Access Policy Manager (APM)BIG-IPAccess Policy Manager (APM)Check Point Management ServerCheck Point Quantum Security GatewayCheck Point Spark FirewallsArista VeloCloud OrchestratorF5 BIG-IP APMBIG-IP APMSecurity GatewaySpark Firewall
Threat actors
UNC5174
Organizations
F5CISACERT-EUShadowserver FoundationCheck Point SoftwareAristaF5 NetworksCheck PointQualyswatchTowr LabsBIG-IPShadowserver
Countries
United StatesEuropean UnionChinaUnited Kingdom

Coverage

oldest first · one row per article · UTC
  1. · Sep 23, 2026 BleepingComputerFirst report

    F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks

    F5 patched actively exploited BIG-IP APM zero-day CVE-2026-94127 enabling remote code execution; CISA added it to KEV with a federal patch deadline.

  2. · Sep 23, 2026 SecurityWeek

    Critical F5 BIG-IP Vulnerability Exploited as Zero-Day

    F5 and CISA warned of an actively exploited critical zero-day (CVE-2026-94127) in BIG-IP APM enabling unauthenticated remote code execution.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2023-46747
F5 BIG-IP TMUI Authentication Bypass Enables Unauthenticated RCE
9.897%KEVRansomwarePoC ×2
KEV
CVE-2025-5352
A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the…
9.6<1%PoC
CVE-2026-85102
Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
9.854%KEVPoC
KEV
CVE-2026-93616
Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload
9.892%KEVPoC
KEV
CVE-2026-93952
Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem)
9.51%KEV
KEV
CVE-2026-94127
Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile
9.325%KEVPoC ×2
KEV