Published Wednesday, September 23, 2026 at 05:28 AM PT
BLUF: F5 BIG-IP Access Policy Manager (APM) contains a critical unauthenticated remote code execution vulnerability (CVE-2026-94127) that has been actively exploited in the wild. Patch immediately. All organizations running BIG-IP APM are affected.
DETAILS:
- CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager affecting OAuth server deployments
- Vulnerability permits unauthenticated remote attackers to achieve code execution without credentials
- Zero-day exploitation confirmed in active attacks prior to F5’s security advisory (published September 22, 2026)
- F5 released patches as of the advisory date; patch status for all affected versions to be confirmed via F5 security advisory
IMPACT:
- All F5 BIG-IP APM deployments, particularly those exposed to untrusted networks or serving as OAuth authentication layers, are directly at risk
- Affected organizations: enterprises using BIG-IP APM for application access control, VPN gateways, or federated authentication
- Threat actors can gain immediate remote shell access without authentication; potential for lateral movement, data exfiltration, and persistent backdoors
- OAuth/SAML infrastructure compromise could cascade to downstream applications
RECOMMENDED ACTIONS:
- Prioritize patching all BIG-IP APM systems immediately — treat as critical
- Consult F5’s published advisory for version-specific patch guidance (released September 22, 2026)
- Until patched, consider network segmentation or WAF rules to restrict APM traffic to known legitimate sources
- Review access logs for September 2026 onward for exploit indicators (malformed buffer inputs to authentication handlers)
- Assume breach posture: reset credentials for any service relying on compromised BIG-IP APM instances
SOURCES:
- Rapid7 (September 22, 2026 advisory); news4hackers; The Hacker News; BleepingComputer; SecurityWeek
Recent high-severity events at publish time:
