Reported by 25 outlets
An exploited BIG-IP APM vulnerability tracked as CVE-2026-94127 allows RCE attacks. Secure your BIG-IP APM vulnerability deployments with ne
Why this score
- Breadth
- 2.00 / 2.0 · 25 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.32 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
F5 disclosed CVE-2026-94127 on September 22, 2026 and confirmed the next day that it is being exploited in the wild. The bug is a heap-based buffer overflow (CWE-122) in BIG-IP Access Policy Manager, CVSS 9.8 (v4.0: 9.3), giving unauthenticated remote code execution. It only triggers when a virtual server runs an APM access policy together with an OAuth profile and APM acts as an OAuth Authorization Server; pure Client or Resource Server deployments are unaffected, though Appliance mode is vulnerable. CISA added it to KEV the same day with a September 25 remediation deadline for federal agencies.
Affected branches are 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3, with engineering hotfixes issued for each. Shadowserver tracks more than 14,700 exposed BIG-IP APM endpoints. F5 published IoCs, including repeated OAuth UserInfo invalid_token failures in /var/log/apm, drift in the tmctl global_oauth_stat total_failed counter, and TMM core dumps after a SIGABRT, plus an iRule mitigation for systems that cannot patch immediately. CERT-EU and Canada's Cyber Centre both relayed the advisory with an evidence-first response order: preserve forensics, hotfix, then compromise assessment.
Public technical analysis has moved fast. watchTowr and Picus describe the OAuth UserInfo handler allocating 0x4100 bytes but copying the attacker-controlled Authorization header without bounds, corrupting an adjacent callback pointer, pivoting to a ROP chain that appends a command to tmm.finish, which Bash then executes after the TMM crash, bypassing SELinux. Coverage on September 25 points to a working PoC.
Edge identity gateways are the highest-value RCE target class right now, and this one needs no credentials and no user interaction. Watch for worm-scale scanning, F5 exploitation confirmations beyond the initial advisory, and whether KEV-driven federal patching beats the September 25 deadline.
Timeline
-
original reporting
An exploited BIG-IP APM vulnerability tracked as CVE-2026-94127 allows RCE attacks. Secure your BIG-IP APM vulnerability deployments with ne
securityonline.info · 21d ago · September 22nd, 2026
An exploited BIG-IP APM vulnerability tracked as CVE-2026-94127 allows RCE attacks. Secure your BIG-IP APM vulnerability deployments with ne
via Mastodon https://securityonline.info/big-ip-apm-vulnerability-cve-2026-94127/?utm_source=mastodon&utm_medium=jetpack_social
-
update from my.f5.com
K000162605: BIG-IP APM vulnerability CVE-2026-94127
my.f5.com · 22d ago · September 22nd, 2026
The primary F5 security advisory, published September 22, 2026 (page shows date only; the Canadian Centre for Cyber Security alert AV26-949 issued the same morning already cites it). It confirms exploitation in the wild, assigns internal ID 2524777, rates the APM OAuth Authorization Server heap overflow CWE-122 at CVSS v3.1 9.8 and v4.0 9.3, and lists the affected branches 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3 with their engineering hotfixes. It also carries the vendor's IoC guidance: repeated OAuth UserInfo invalid_token failures in /var/log/apm, tmctl global_oauth_stat total_failed drift, /var/log/audit review, and TMM core files after a SOD SIGABRT, plus an iRule mitigation available from F5 Support.
-
update from cert.europa.eu
Security Advisory 2026-013: Critical Vulnerability in F5 BIG-IP APM
cert.europa.eu · 21d ago · September 22nd, 2026
CERT-EU advisory released 22-09-2026 16:52:36 Brussels time (site timestamp, CEST), about an hour before this story's first event. It relays the F5 advisory with the vendor-confirmed active exploitation, the affected version ranges, and a recommended response order: preserve forensic evidence first, then apply the hotfix, then run a compromise assessment against the vendor IoCs. It reproduces the /var/log/apm and tmctl detection commands and notes the iRule mitigation for unpatchable systems.
-
update from malware.news
F5 security advisory (AV26-949)
malware.news · 21d ago · September 22nd, 2026
Serial number: AV26-949 Date: September 22, 2026 As of September 22, 2026, F5 is affected by a vulnerability in the following product: BIG-IP Versions 21.1.0 to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG Versions 17.5.0 to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG Versions 17.1.0 to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG F5 has reported that CVE-2026-94127 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
-
update from malware.news
AL26-022 - Vulnerability impacting F5 BIG-IP Access Policy Manager (APM) – CVE-2026-94127
malware.news · 21d ago · September 22nd, 2026
Number: AL26-022 Date: September 22, 2026 Audience This Alert is intended for IT professionals and managers. Purpose The Canadian Centre for Cyber Security (Cyber Centre) is aware of a critical vulnerability affecting F5 BIG IP Access Policy Manager (APM) Footnote 1 . Under these conditions, specially crafted malicious traffic may allow an unauthenticated attacker to execute arbitrary code on the affected device, potentially resulting in remote code execution and full system compromise. Suggested actions The Cyber Centre strongly recommends that organizations running affected F5 BIG‑IP APM deployments upgrade to the following vendor-supported fixed hotfix releases: Affected product Affected versions Fixed Versions BIG IP APM Versions 17.1.0 prior to Hotfix-BIGIP-17.1.3.
-
update from gbhackers.com
Critical F5 BIG-IP APM Flaw Actively Exploited for Remote Code Execution
gbhackers.com · 21d ago · September 23rd, 2026
This vulnerability, tracked as CVE-2026-94127, allows unauthenticated attackers to execute code on affected BIG-IP systems when a vulnerable OAuth configuration is exposed through an APM virtual server. Published on September 22, […] The post Critical F5 BIG-IP APM Flaw Actively Exploited for Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Critical F5 BIG-IP APM Flaw Actively Exploited for Unauthenticated RCE
cyberpress.org · 20d ago · September 23rd, 2026
The bug stems from a heap-based buffer overflow (CWE-122) that occurs when a BIG-IP APM access policy and an OAuth profile are configured together on a virtual server. Critical F5 BIG-IP APM Flaw Specially crafted malicious traffic sent to such a virtual server can trigger memory corruption leading to code execution. Critically, the flaw only affects deployments where APM is configured as an OAuth Authorization Server; systems using APM strictly as an OAuth Client or Resource Server, without authorization server profiles, remain unaffected. F5 confirmed this is a data-plane issue with no control-plane exposure , but the impact is severe: an attacker needs no credentials to compromise the system, and BIG-IP instances running in Appliance mode are equally vulnerable. F5 has assigned internal tracking ID 2524777 to the issue and rated it Critical, with a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3. Affected Versions The vulnerability impacts BIG-IP APM running the OAuth feature across two branches.
-
update from bleepingcomputer.com
F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks
bleepingcomputer.com · 20d ago · September 23rd, 2026
BIG-IP APM (short for Access Policy Manager) is the company's centralized access management proxy solution that helps admins secure access to their organizations' networks, applications, cloud, and application programming interfaces (APIs). "We have learned that this vulnerability has been exploited," F5 warned in a security advisory published on Tuesday. F5 also shared mitigation measures for admins who can't immediately install the security updates, which require applying an iRule (available from F5 Support ) to the affected BIG-IP APM virtual server. Internet threat monitoring non-profit Shadowserver currently tracks over 14,700 IP addresses with BIG-IP APM fingerprints . However, there is no information on how many have already been patched or are honeypots. F5 BIG-IP APM exposed onl
-
update from www.bleepingcomputer.com
F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks https:// bleepingcomputer.com/news/security/ f5-warns-of-big-ip-apm-remote-code
www.bleepingcomputer.com · 20d ago · September 23rd, 2026
F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks https:// bleepingcomputer.com/news/security/ f5-warns-of-big-ip-apm-remote-code
via X https://www.bleepingcomputer.com/news/security/f5-warns-of-big-ip-apm-remote-code-execution-zero-day-exploited-in-attacks/
-
update from securityweek.com
Critical F5 BIG-IP Vulnerability Exploited as Zero-Day
securityweek.com · 20d ago · September 23rd, 2026
“We have learned that this vulnerability has been exploited,” F5 says, noting that it discovered the security defect internally. Additionally, the company published three indicators of compromise (IoCs), noting that their combined and frequent appearance should be correlated to an attack. Just as F5 published its advisory, CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities ( KEV ) list, urging federal agencies to patch it within three da
-
update from rapid7.com
CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM
rapid7.com · 20d ago · September 23rd, 2026
BIG-IP APM provides identity-aware access control for applications and other corporate resources and can integrate with authentication technologies including OAuth, OpenID Connect, and SAML. Because affected BIG-IP systems may process traffic at an organization's network edge, organizations using this configuration should prioritize remediation.
-
mentioned by cybertop.ai
CVE-2026-94127: F5 BIG-IP APM heap-based buffer overflow vulnerability actively exploited. Defense: Disable or restrict access to vulnerable
cybertop.ai · 20d ago · September 23rd, 2026
-
mentioned by thehackernews.com
🤖 CVE-2026-94127: critical F5 BIG-IP APM zero-day exploited in the wild for unauthRCE. Affects systems where APM acts as OAuth authorization
thehackernews.com · 20d ago · September 23rd, 2026
-
mentioned by zubiqo.com
F5 patched a critical BIG-IP APM zero-day, CVE-2026-94127, under active RCE exploitation. Over 14,700 exposed appliances are visible online,
zubiqo.com · 20d ago · September 23rd, 2026
-
update from bleepingcomputer.com
F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks
bleepingcomputer.com · 20d ago · September 23rd, 2026
submitted by /u/Vast_Hope_7185 [link] [comments]
via reddit r/cybersecurity: F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks
-
mentioned by radar.offseq.com
F5 BIG-IP APM (OAuth Authorization Server) is facing a CRITICAL RCE zero-day, CVE-2026-94127, with active exploitation. Versions 21.1.0, 17.
radar.offseq.com · 20d ago · September 23rd, 2026
-
mentioned by www.yazoul.net
🔴 New security advisory: CVE-2026-94127 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R
www.yazoul.net · 20d ago · September 23rd, 2026
-
mentioned by www.yazoul.net
🔴 New security advisory: CVE-2026-94127 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R
www.yazoul.net · 20d ago · September 23rd, 2026
-
update from socprime.com
CVE-2026-94127: Critical F5 BIG-IP APM Zero-Day Exploited for Remote Code Execution
socprime.com · 20d ago · September 23rd, 2026
F5 assigned it a CVSS v3.1 score of 9.8 , while its CVSS v4.0 score is 9.3 , reflecting a network-accessible attack path with low complexity, no privileges required, and no user interaction. Exposure depends on configuration rather than simply having BIG-IP APM installed. Contact Sales F5 published its advisory on September 22, 2026 after determining that attackers were already exploiting the vulnerability. federal civilian agencies to remediate by September 25, 2026 . CVE-2026-94127 analysis The vulnerability exists in the BIG-IP APM OAuth functionality and results from improper handling of memory when the system processes specially craft
-
mentioned by suriq.io
🔴 EXPLOITED F5 BIG-IP APM has a max-severity flaw (CVE-2026-94127) that lets a stranger run code with no login, but only when APM is your OA
suriq.io · 20d ago · September 23rd, 2026
-
mentioned by kudelskisecurity.com
(kudelskisecurity.com) Critical Heap Overflow in F5 BIG-IP APM OAuth Authorization Server Enables Unauthenticated Remote Code Execution In b
kudelskisecurity.com · 20d ago · September 23rd, 2026
-
mentioned by cyber.netsecops.io
📰 F5 BIG-IP APM Zero-Day (CVE-2026-94127) Actively Exploited for RCE F5 BIG-IP APM is being actively exploited via a critical RCE zero-day (
cyber.netsecops.io · 20d ago · September 23rd, 2026
-
mentioned by labs.watchtowr.com
Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) - watchTowr Labs
labs.watchtowr.com · 20d ago · September 23rd, 2026
-
update from www.heise.de
Angriffe laufen: https://www. heise.de/news/Cyberangriffe-au f-F5-BIG-IP-Check-Point-Security-und-Arista-VeloCloud-11462590.html # infosec #
www.heise.de · 20d ago · September 24th, 2026
Angriffe laufen: https://www. heise.de/news/Cyberangriffe-au f-F5-BIG-IP-Check-Point-Security-und-Arista-VeloCloud-11462590.html # infosec #
via Mastodon https://www.heise.de/news/Cyberangriffe-auf-F5-BIG-IP-Check-Point-Security-und-Arista-VeloCloud-11462590.html
-
mentioned by cyberwald.com
Cyberwald Cybersecurity News Podcast 24.09.2026: F5 BIG-IP APM Zero-Day CVE-2026-94127 and Arista VeloCloud Zero-Day
cyberwald.com · 19d ago · September 24th, 2026
-
mentioned by labs.watchtowr.com
(labs.watchtowr.com) Critical Heap Buffer Overflow in F5 BIG-IP OAuth Implementation: CVE-2026-94127 Analysis and Exploitation In brief - Th
labs.watchtowr.com · 19d ago · September 24th, 2026
-
mentioned by diesec.com
F5 confirms exploitation of CVE-2026-94127 (CVSS 9.8): unauth RCE in BIG-IP APM's OAuth Authorization Server role. CISA KEV same day, deadli
diesec.com · 19d ago · September 24th, 2026
-
mentioned by diesec.com
(diesec.com) Critical F5 BIG-IP APM RCE Vulnerability (CVE-2026-94127) Actively Exploited in the Wild In brief - This article discusses a cr
diesec.com · 19d ago · September 24th, 2026
-
update from dev.to
F5 BIG-IP APM CVE-2026-94127: Pre-authentication RCE Zero-Day Targeting OAuth Configurations # security # threatintel # software # coding #
dev.to · 19d ago · September 24th, 2026
F5 BIG-IP APM CVE-2026-94127: Pre-authentication RCE Zero-Day Targeting OAuth Configurations # security # threatintel # software # coding #
via Mastodon https://dev.to/anoymask/f5-big-ip-apm-cve-2026-94127-pre-authentication-rce-zero-day-targeting-oauth-configurations-30bn
-
update from malware.news
CVE-2026-94127 Explained: F5 BIG-IP APM Heap Overflow Attack
malware.news · 19d ago · September 24th, 2026
The OAuth UserInfo handler allocates 0x4100 bytes but copies an attacker-controlled Authorization header without enforcing that limit. The overflow corrupts a neighboring callback pointer, enabling a stack pivot and a return-oriented programming chain. The chain appends a command to tmm.finish , which Bash runs after TMM crashes, bypassing SELinux restrictions. The Picus Platform lets teams simulate CVE-2026-94127 attacks to validate security controls against the exploitation.
-
mentioned by www.picussecurity.com
(picussecurity.com) Critical Heap Overflow in F5 BIG-IP APM: Unauthenticated RCE via CVE-2026-94127 In brief - This article explains CVE-202
www.picussecurity.com · 19d ago · September 24th, 2026
-
mentioned by www.picussecurity.com
New. Picus: CVE-2026-94127 Explained: F5 BIG-IP APM Heap Overflow Attack https://www. picussecurity.com/resource/blo g/cve-2026-94127-explai
www.picussecurity.com · 19d ago · September 24th, 2026
-
update from labs.watchtowr.com
WatchTower posted this yesterday: WatchTower: Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127) htt
labs.watchtowr.com · 19d ago · September 24th, 2026
WatchTower posted this yesterday: WatchTower: Is This A Joke? In The Auth Header?
-
mentioned by securityonline.info
An exploited F5 BIG-IP RCE vulnerability (CVE-2026-94127) is under active attack. Discover how the PoC works and patch your APM proxies imme
securityonline.info · 19d ago · September 25th, 2026
-
mentioned by cyber.netsecops.io
📰 F5 BIG-IP APM Zero-Day (CVE-2026-94127) Actively Exploited for RCE F5 BIG-IP APM is being actively exploited via a critical RCE zero-day (
cyber.netsecops.io · 18d ago · September 25th, 2026