Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution

• •CVE-2026-94127 allows unauthenticated remote code execution on vulnerable BIG-IP APM systems.
• •The vulnerability is actively exploited and has a CVSS score of 9.8, indicating critical severity.
• •Organizations must apply hotfixes or mitigation measures by September 25, 2026, to avoid exploitation.

F5 Networks has reported a critical vulnerability in its BIG-IP Access Policy Manager (APM), tracked as CVE-2026-94127, which is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute remote code on systems configured with both an APM access policy and an OAuth profile. This vulnerability has a CVSS score of 9.8 and affects versions 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3. F5 disclosed the vulnerability on September 22, 2026, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog the same day. Organizations are urged to apply the provided hotfixes immediately, as the vulnerability poses significant risks to internet-facing deployments. The flaw is classified as a data plane issue, meaning it can be exploited without accessing the management interface. F5 has also provided mitigation measures for those unable to patch immediately.