Someone's attacking a critical 0-day RCE in F5 BIG-IP APM

F5 has patched a critical zero-day vulnerability in its BIG-IP Access Policy Manager (APM), which was being exploited by unknown attackers to execute malicious code remotely. The flaw, identified as CVE-2026-94127, is a heap-based buffer overflow that affects systems configured as an OAuth Authorization Server with an access policy and OAuth profile on the same virtual server.

The issue received a critical CVSS v4.0 score of 9.3, emphasizing the urgency for immediate action. F5 announced the exploitation of this vulnerability, though they have not disclosed the number of compromised systems or whether criminals are using it to deploy ransomware. The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog, urging federal agencies to apply patches by Friday.

This comes one year after F5 and CISA warned of a sophisticated nation-state attack that stole BIG-IP source code, zero-day vulnerability details, and customer configuration data from some users, posing an imminent risk to federal agencies. The Justice Department delayed public disclosure of the intrusion to avoid potential harm to national security or public safety.

While neither the federal government nor private researchers have publicly attributed the breach to a specific group or country, previous research by Google's Mandiant linked exploitation of another critical F5 BIG-IP flaw to UNC5174, an access broker suspected of operating from China and attempting to sell access to US defense contractors and UK government entities.