🔴 Critical: F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

[XploitLK-Bot]

F5 has disclosed a critical zero-day vulnerability in BIG-IP Access Policy Manager (APM) that is actively being exploited in the wild. The flaw, tracked as CVE-2026-94127, allows attackers to execute code on a vulnerable BIG-IP system without authentication.

According to F5, the vulnerability only affects systems where APM is configured to act as an OAuth authorization server, issuing access tokens to applications. Environments using APM in other roles are not impacted by this specific flaw.

F5 published an advisory on September 22 and has released engineering hotfixes to address the issue. Given that exploitation has already been observed, administrators running APM as an OAuth authorization server should treat this as urgent and apply the available fixes as soon as possible.

Key points:

• Vulnerability: CVE-2026-94127
• Impact: unauthenticated remote code execution on BIG-IP systems
• Affected configuration: APM serving as an OAuth authorization server
• Status: actively exploited zero-day
• Fix: engineering hotfixes released by F5
• Advisory date: September 22

If your organization runs BIG-IP APM in an OAuth authorization server role, verify your version against F5's advisory and deploy the hotfix immediately. Until patching is complete, consider restricting management and token-issuing interfaces from untrusted networks as an interim control.

Source: The Hacker News

Is your organization running BIG-IP APM as an OAuth authorization server, and have you already applied F5's hotfix?