CVE Tools
Track your stack

Critical F5 BIG-IP Vulnerability Exploited as Zero-Day

SecurityWeekBy Ionut Arghire

Reported exploitedBIG-IP Access Policy Manager

Our summary

F5 has confirmed active zero-day exploitation of CVE-2026-94127, a CVSS 9.8 vulnerability in BIG-IP Access Policy Manager. Unauthenticated attackers can execute code remotely when a vulnerable BIG-IP APM deployment is configured as an OAuth Authorization Server with an access policy and OAuth profile on a virtual server.

Affected releases are BIG-IP APM 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3; F5 has issued hotfixes. CISA has also added the flaw to its Known Exploited Vulnerabilities catalog, making prompt remediation important.

Read at SecurityWeek

SecurityWeek publishes this story on its own site; we link to it rather than reprint it.

  1. watchTowr LabsIs This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)CVE-2026-94127
  2. Help Net SecurityAttackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instancesCVE-2026-94127
  3. The Hacker NewsF5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth ServersCVE-2026-94127
  4. BleepingComputerF5 patches BIG-IP APM zero-day flaw exploited in RCE attacksCVE-2026-94127

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store