Critical F5 BIG-IP Vulnerability Exploited as Zero-Day
Critical F5 BIG-IP vulnerability exploited as zero-day, allowing unauthenticated RCE.
F5 has issued a warning that threat actors are actively exploiting a critical vulnerability in its BIG-IP Access Policy Manager (APM) as a zero-day. The flaw, tracked as CVE-2026-94127 with a CVSS score of 9.8, allows unauthenticated attackers to achieve remote code execution when BIG-IP APM is configured with an OAuth profile. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch it within three days.
AI summary of the linked source. Not reviewed by an editor. How this works
Run F5?
Get an email when a new story names F5, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical unauthenticated remote code execution vulnerability (CVE-2026-94127, CVSS 9.8) in F5 BIG-IP Access Policy Manager is being actively exploited as a zero-day, meaning attackers moved faster than defenders could apply patches. The flaw is triggered specifically when the OAuth profile is enabled, highlighting how certain configuration choices can dramatically expand an attack surface. CISA's inclusion in the Known Exploited Vulnerabilities catalog and a three-day federal patching mandate underscore the severity and urgency of the risk. Organizations that lack rapid patch deployment processes or asset visibility for internet-facing appliances are most exposed, and successful exploitation could grant attackers full control over critical network infrastructure.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-94127