Back Ncsa.Qa

NCSA - Cybersecurity Advisories - الوكالة الوطنية للأمن السيبراني

Ncsa.Qa • September 23, 2026

On 22 September 2026, F5 disclosed CVE-2026-94127, a critical vulnerability affecting BIG-IP Access Policy Manager (APM), and confirmed that it is being actively exploited in the wild. The vulnerability may allow an unauthenticated remote attacker to execute arbitrary code on affected BIG-IP systems.

CVE-2026-94127 is a heap-based buffer overflow vulnerability (CWE-122) affecting F5 BIG-IP APM. The vulnerability affects systems where an Acess Policy Manager (APM) access policy and an OAuth profile are configured on the same virtual server. Specially crafted traffic may allow an unauthenticated remote attacker to execute arbitrary code on the affected BIG-IP device. The vulnerability has a CVSS v3.1 score of 9.8 (Critical). Exploitation can occur remotely with low attack complexity and requires no privileges or user interaction, with potentially high impact on integrity, and availability. F5 released hotfixes for affected systems and confirmed that the vulnerability is being actively exploited in the wild as a zero-day. CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog on 22 September 2026, further highlighting the urgency of applying the available security updates.

Apply vendor-recommended patches and mitigations in accordance with vendor instructions, ensuring alignment with NCSA’s Qatar National Vulnerability Management Guidelines, Version 1.0 including its risk-based prioritization and Reference SLA Matrix. Stakeholders are responsible for evaluating the affected asset’s criticality and internet exposure, prioritizing remediation accordingly, and ensuring that vulnerabilities are remediated within the applicable NCSA timeframe. Where immediate remediation is not feasible, the vulnerability should be formally tracked and managed through the organization’s vulnerability and risk management process until remediation is completed.

We use cookies to enhance your experience on our website. Click 'Accept All' to consent.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution F5 Networks has reported a critical vulnerability in its BIG-IP Access Policy Manager (APM), tracked as CVE-2026-94127, which is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute remote code on systems configured with both an APM access policy and an OAuth profile. This vulnerability has a CVSS score of 9.8 and affects versions 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3. F5 disclosed the vulnerability on September 22, 2026, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog the same day. Organizations are urged to apply the provided hotfixes immediately, as the vulnerability poses significant risks to internet-facing deployments. The flaw is classified as a data plane issue, meaning it can be exploited without accessing the management interface. F5 has also provided mitigation measures for those unable to patch immediately. 25 sources 82

Extracted Entities

NCSA - Cybersecurity Advisories - الوكالة الوطنية للأمن السيبراني

The full story

Extracted Entities

Attack Types (1)

Countries (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)