F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

T2Critical 85Covered by 1 source · first reported by The Hacker News at 23 Sept, 08:29 UTC

Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5…

security

Sources

• T2F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth ServersThe Hacker News23 Sept, 08:29

Vulnerabilities

• CVE-2026-94127