Back Hkcert

F5 BIG-IP Denial of Service Vulnerability

Hkcert • September 23, 2026

A vulnerability was identified in F5 BIG-IP. A remote attacker could exploit this vulnerability to trigger remote code execution on the targeted system.

CVE-2026-94127 is being exploited in the wild. This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Hence, the risk level is rated as High Risk.

Remote Code Execution

System / Technologies affected

Versions 17.1.0 - 17.1.3

Versions 17.5.0 - 17.5.1

Please visit the vendor web-site for more details.

Apply workarounds issued by the vendor:

Vulnerability Identifier

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution F5 Networks has reported a critical vulnerability in its BIG-IP Access Policy Manager (APM), tracked as CVE-2026-94127, which is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute remote code on systems configured with both an APM access policy and an OAuth profile. This vulnerability has a CVSS score of 9.8 and affects versions 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3. F5 disclosed the vulnerability on September 22, 2026, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog the same day. Organizations are urged to apply the provided hotfixes immediately, as the vulnerability poses significant risks to internet-facing deployments. The flaw is classified as a data plane issue, meaning it can be exploited without accessing the management interface. F5 has also provided mitigation measures for those unable to patch immediately. 25 sources 82

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

CVE-2026-94127