Someone's attacking a critical 0-day RCE in F5 BIG-IP APM
Good news: there's a patch. Bad news: both CISA and F5 warn that it's under active exploitation
F5 has patched a critical zero-day vulnerability in its BIG-IP Access Policy Manager (APM), which attackers were exploiting to execute malicious code remotely. This flaw, identified as CVE-2026-94127, is a heap-based buffer overflow affecting systems configured as OAuth Authorization Servers with specific access policies and OAuth profiles.
The vulnerability was rated with a critical 9.3 CVSS v4.0 score by F5. F5 received an alert from the US Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday, urging federal agencies to apply the patches by Friday. This development follows a year ago when F5 and CISA warned of a potential intrusion by sophisticated nation-state hackers who stole BIG-IP source code, zero-day vulnerability details, and customer configurations.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Someone's attacking a critical 0-day RCE in F5 BIG-IP APM theregister.com
