F5 has rushed out emergency hotfixes for a critical zero-day vulnerability in its BIG-IP Access Policy Manager (APM), tracked as CVE-2026-94127, and confirmed the flaw is already being actively exploited in the wild.
The heap-based buffer overflow, rated 9.8 out of 10 on the CVSS severity scale, allows unauthenticated attackers to execute arbitrary code on vulnerable systems configured as OAuth authorization servers.
BIG-IP APM is a widely deployed access and identity component that sits at the edge of corporate networks, controlling logins, authorization and VPN connectivity. A remote code execution flaw in that layer effectively hands attackers the keys to everything behind it.
How the flaw is exploited
The vulnerability triggers in deployments where an access policy and an OAuth profile are configured on the same virtual server, with APM acting as the OAuth authorization server. Attackers can send malicious traffic directly to that virtual server to trigger the buffer overflow and run commands on the appliance.
Crucially, F5 says this is a data-plane issue rather than a control-plane one, which means locking down the BIG-IP management interface does not block exploitation. Systems running in appliance mode are also affected.
Deployments that use APM strictly as an OAuth client or resource server are not vulnerable, and versions that have reached end of technical support were not evaluated, so F5 warns they should not be assumed safe.
PoC goes public as pressure mounts
The stakes rose sharply after security researchers at watchTowr published a detailed technical analysis alongside a working proof-of-concept exploit. With weaponized code now circulating publicly, analysts warn that opportunistic attacks against unpatched systems could scale quickly.
The disclosure also drew the attention of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog on September 22, 2026, giving U.S. federal civilian agencies just three days to apply mitigations.
Threat intelligence firm Shadowserver has identified more than 14,700 BIG-IP APM IPs exposed on the internet, although not all of them run the vulnerable configuration or remain unpatched.
What security teams should do
F5 has released engineering hotfixes for the affected branches — 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3 — and urges customers to apply them immediately. For teams that cannot patch right away, the company is distributing a temporary iRule through its support portal that can be deployed on affected virtual servers as a stopgap.
The incident arrives roughly a year after sophisticated attackers stole BIG-IP source code and customer data from F5 itself, and it continues a bruising year for access and identity infrastructure, with emergency patches also shipped by Cisco and Citrix.
Security leaders say the episode is a reminder that the gateways sitting at the network edge remain among the most attractive — and hardest to take offline for maintenance — targets in any enterprise.
