F5 says attackers are exploiting a critical flaw in BIG-IP Access Policy Manager, a product many organizations use to control remote and application access. The bug, CVE-2026-94127, affects BIG-IP APM instances configured as an OAuth authorization server when both an access policy and an OAuth profile are set on a virtual server, and can be used for remote code execution. F5 released patches and an iRule mitigation for organizations that cannot update immediately, and CISA added the flaw to its Known Exploited Vulnerabilities catalog.
Why it matters: Organizations using affected BIG-IP APM setups could be exposed to direct break-ins, so this is an update-now issue. Defenders should identify whether APM is configured as an OAuth authorization server, apply F5’s fixes or mitigation immediately, and check for signs of compromise.
2026.09.23
99% relevant
This article is a direct report on the same event, adding that CISA placed CVE-2026-94127 in the KEV catalog with a Friday deadline for federal agencies and restating the vulnerable BIG-IP APM OAuth Authorization Server configuration details.
info@thehackernews.com (The Hacker News)
2026.09.23
99% relevant
This article appears to report the same underlying event: F5 releasing a patch for an actively exploited critical BIG-IP APM zero-day enabling unauthenticated remote code execution, with added emphasis that OAuth servers are affected.
Ionut Arghire
2026.09.23
99% relevant
This article reports the same underlying event: F5 and CISA warning that CVE-2026-94127 in BIG-IP APM was exploited as a zero-day, adds that exploitation requires APM configured as an OAuth Authorization Server on a virtual server, notes affected version ranges, hotfix availability, IoCs, and the three-day federal patch deadline after KEV inclusion.
Sergiu Gatlan
2026.09.23
100% relevant
This article appears to be the first item here establishing the newly disclosed and actively exploited BIG-IP APM zero-day CVE-2026-94127 as a distinct tracked event.
← Back to all stories