Skip to content
Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution

Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution

First seen 22 Sep 2026, 21:25 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 23, 2026 at 20:58 UTC
  • •CVE-2026-94127 allows unauthenticated remote code execution on vulnerable BIG-IP APM systems.
  • •The vulnerability is actively exploited and has a CVSS score of 9.8, indicating critical severity.
  • •Organizations must apply hotfixes or mitigation measures by September 25, 2026, to avoid exploitation.

F5 Networks has reported a critical vulnerability in its BIG-IP Access Policy Manager (APM), tracked as CVE-2026-94127, which is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute remote code on systems configured with both an APM access policy and an OAuth profile. This vulnerability has a CVSS score of 9.8 and affects versions 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3. F5 disclosed the vulnerability on September 22, 2026, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog the same day. Organizations are urged to apply the provided hotfixes immediately, as the vulnerability poses significant risks to internet-facing deployments. The flaw is classified as a data plane issue, meaning it can be exploited without accessing the management interface. F5 has also provided mitigation measures for those unable to patch immediately.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 25d ago How this analysis works

Timeline

2025-10-15
CVE-2025-53521 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-22
CVE-2026-94127 disclosed
F5 disclosed a critical vulnerability in BIG-IP APM, allowing remote code execution under specific configurations.
Fieldeffect
2026-09-22
CISA adds CVE-2026-94127 to KEV
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate remediation.
Thehackernews
2026-09-23
F5 releases hotfixes
F5 released engineering hotfixes for affected BIG-IP APM versions to address the vulnerability.
Securityweek

More articles in this cluster (33)

Following this threat?

Track F5 Networks and CVE-2025-53521 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 4