F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers
Summary: F5 disclosed CVE-2026-94127 on September 22, a heap-based buffer overflow in BIG-IP Access Policy Manager that lets unauthenticated attackers run code on a BIG-IP system when APM serves as an OAuth authorization server, rated 9.8 on CVSS v3.1 and 9.3 on CVSS v4.0. CISA added the flaw to its KEV catalog the same day and gave federal civilian agencies until September 25 to apply F5's mitigations, and F5 has released engineering hotfixes while noting that restricting access to the BIG-IP management interface does not protect against the flaw.
Key Takeaway: The malicious traffic hits the virtual server itself, so the management-interface controls most teams rely on do nothing here, and CISA's three-day deadline signals exploitation is already underway. F5's record does not say whether the hotfix removes access an attacker already holds, so patching alone may not close the door.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-53521CVE-2026-94127
- Related
- CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Sep 22, 2026CVE-2025-53521: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Mar 27, 2026