F5 patches an exploited BIG-IP APM flaw affecting some OAuth server deployments · Digg

F5 patches an exploited BIG-IP APM flaw affecting some OAuth server deployments

F5 says CVE-2026-94127 has been exploited in the wild. The issue is reported to affect a specific BIG-IP Access Policy Manager configuration, not every BIG-IP installation.

2 Sources, 9h ago, first seen 9h ago

TLDR

F5 has issued an advisory for CVE-2026-94127, a critical BIG-IP Access Policy Manager vulnerability that it says has been exploited in the wild. Reporting says the exposure is tied to deployments using APM as an OAuth Authorization Server with both an access policy and OAuth profile on a virtual server. That configuration detail matters: organizations should identify whether they run it, consult F5’s advisory for affected releases and remediation, and treat the issue as an urgent security-maintenance task rather than assuming every BIG-IP system has the same exposure.

Featured Source

F5 has issued an advisory for CVE-2026-94127, a critical vulnerability in BIG-IP Access Policy Manager. The Canadian Centre for Cyber Security says F5 has reported that the flaw is being exploited in the wild.

The scope is important. According to BleepingComputer’s report, the affected setup is a BIG-IP APM deployment configured as an OAuth Authorization Server, with both an APM access policy and an OAuth profile on a virtual server. That is narrower than saying every BIG-IP installation is exposed, but it is still a serious concern for organizations using the appliance in that role.

Start with the configuration

BIG-IP APM is used to manage access to applications and services. In the reported vulnerable setup, it also sits in an OAuth token-issuing path. Rapid7’s analysis describes CVE-2026-94127 as a critical heap-based buffer-overflow issue.

Administrators should compare their BIG-IP APM configuration and release against F5’s advisory, then follow F5’s remediation guidance for any affected deployment. Because F5 says exploitation has already occurred, this is not a case for waiting on a routine maintenance window. The immediate operational question is whether the OAuth server, access-policy and OAuth-profile combination exists in the environment, and whether the affected systems have received the vendor’s fix or mitigation.

2 Sources

@BleepinComputerF5 patches BIG-IP APM zero-day flaw exploited in RCE attacks https://www.bleepingcomputer.com/news/security/f5-warns-of-big-ip-apm-remote-code-execution-zero-day-exploited-in-attacks/ https://www.bleepingcomputer.com/news/security/f5-warns-of-big-ip-apm-remote-code-execution-zero-day-exploited-in-attacks/

@SecurityWeekCritical F5 BIG-IP Vulnerability Exploited as Zero-Day https://www.securityweek.com/critical-f5-big-ip-vulnerability-exploited-as-zero-day/

Today's Rank

—

Not ranked yet

Combined views

8.4K

2 Sources, first seen 9h ago

23 likes

F5 patches an exploited BIG-IP APM flaw affecting some OAuth server deployments

TLDR

Start with the configuration

F5 patches an exploited BIG-IP APM flaw affecting some OAuth server deployments

2 Sources

Combined views

Start with the configuration

Combined views

Sentiment

Summary

TLDR

Start with the configuration

Sentiment

Summary

Sentiment

Summary

Start with the configuration

2 Sources

Sentiment

Summary