CyberSecurity News

F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

The Hacker News

· September 23, 2026

AI summary

A critical vulnerability in F5 BIG-IP Access Policy Manager is being exploited by attackers, allowing them to execute code on a BIG-IP system without authentication. The flaw is specific to systems where APM acts as an OAuth authorization server, issuing access tokens to applications. F5 has disclosed the issue and released engineering hotfixes to address it. The vulnerability is identified as CVE-2026-94127 and was disclosed in an advisory on September 22.

Vulnerabilities mentioned

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Read the full article at The Hacker Newsthehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.