SecurityOnlineDo Son
F5 Warns Hackers Are Exploiting Critical BIG-IP APM Flaw
Part of the CVE-2026-94127 story · since 22 Sep
- Tue 22 Sep, 18:01 UTC. SecurityOnline, first report. F5 Warns Hackers Are Exploiting Critical BIG-IP APM Flaw. Cites a CVE in CISA KEV. This article, 1st of 10.
- Tue 22 Sep, 20:31 UTC. CISA, its first report on the story. CISA Warns of Active Attacks Exploiting Critical F5 BIG-IP Flaw. Cites a CVE in CISA KEV.
- Wed 23 Sep, 07:36 UTC. SecurityWeek, its first report on the story. F5 BIG-IP APM zero-day lets attackers execute code remotely. Cites a CVE in CISA KEV.
- Wed 23 Sep, 09:59 UTC. Rapid7, its first report on the story. F5 BIG-IP Flaw Enables Unauthenticated Remote Code Execution. Cites a CVE in CISA KEV.
- Wed 23 Sep, 18:14 UTC. Security Affairs, its first report on the story. F5 Patches Exploited BIG-IP Flaw Allowing Unauthenticated Code Execution. Cites a CVE in CISA KEV.
- Wed 23 Sep, 21:50 UTC. Security Affairs. CISA Warns of Active Attacks on Check Point and F5 Flaws. Cites a CVE in CISA KEV.
- Thu 24 Sep, 03:36 UTC. SecurityOnline. Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at Risk. Cites a CVE in CISA KEV.
- Fri 25 Sep, 03:47 UTC. SecurityOnline. F5 Patches Exploited BIG-IP Zero-Day Enabling Remote Code Execution. Cites a CVE in CISA KEV.
- Mon 28 Sep, 02:30 UTC. SecurityOnline. Nine Flaws Exploited as Attackers Target Edge Products and WordPress. Cites a CVE in CISA KEV.
- Mon 28 Sep, 14:30 UTC. Check Point, its first report on the story. Check Point Warns of Active Exploits and AI-Powered Attacks. Cites a CVE in CISA KEV.
On 22 September 2026, F5 disclosed CVE-2026-94127, a critical vulnerability in BIG-IP Access Policy Manager (APM), with a CVSS v3 score of 9.8. F5 said the flaw is being exploited in the wild. It affects BIG-IP versions 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3; other BIG-IP modules and NGINX products are described as unaffected. Appliance-mode systems are also vulnerable.
The issue is a heap-based buffer overflow in the Traffic Management Microkernel’s data plane. Where an APM access policy and OAuth profile are configured on a virtual server, specially crafted network traffic can cause remote code execution without authentication. F5 said this is a data-plane issue, with no control-plane exposure. The article says no public proof-of-concept code has been confirmed.
F5 has issued engineering hotfixes: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. Administrators are urged to apply the relevant update immediately. If that is not possible, F5 Support can provide an emergency iRule mitigation. The report also recommends reviewing logs for repeated OAuth authentication failures.
How the story developed
10 articles from 6 outlets since 22 Sep. Quiet since 28 Sep. This was the first report.
- Tue 22 Sep, 18:01 UTC. SecurityOnline, first report. F5 Warns Hackers Are Exploiting Critical BIG-IP APM Flaw. Cites a CVE in CISA KEV. This article, 1st of 10.
- Tue 22 Sep, 20:31 UTC. CISA, its first report on the story. CISA Warns of Active Attacks Exploiting Critical F5 BIG-IP Flaw. Cites a CVE in CISA KEV.
- Wed 23 Sep, 07:36 UTC. SecurityWeek, its first report on the story. F5 BIG-IP APM zero-day lets attackers execute code remotely. Cites a CVE in CISA KEV.
- Wed 23 Sep, 09:59 UTC. Rapid7, its first report on the story. F5 BIG-IP Flaw Enables Unauthenticated Remote Code Execution. Cites a CVE in CISA KEV.
- Wed 23 Sep, 18:14 UTC. Security Affairs, its first report on the story. F5 Patches Exploited BIG-IP Flaw Allowing Unauthenticated Code Execution. Cites a CVE in CISA KEV.
- Wed 23 Sep, 21:50 UTC. Security Affairs. CISA Warns of Active Attacks on Check Point and F5 Flaws. Cites a CVE in CISA KEV.
- Thu 24 Sep, 03:36 UTC. SecurityOnline. Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at Risk. Cites a CVE in CISA KEV.
- Fri 25 Sep, 03:47 UTC. SecurityOnline. F5 Patches Exploited BIG-IP Zero-Day Enabling Remote Code Execution. Cites a CVE in CISA KEV.
- Mon 28 Sep, 02:30 UTC. SecurityOnline. Nine Flaws Exploited as Attackers Target Edge Products and WordPress. Cites a CVE in CISA KEV.
- Mon 28 Sep, 14:30 UTC. Check Point, its first report on the story. Check Point Warns of Active Exploits and AI-Powered Attacks. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 10 articles as a listHide the list
- Tue 22 SepDay 02
- F5 Warns Hackers Are Exploiting Critical BIG-IP APM Flaw18:01 · SecurityOnline · First report · Known exploited CVE · This article, 1st of 10
- CISA Warns of Active Attacks Exploiting Critical F5 BIG-IP Flaw20:31 · CISA · official · CISA alert · Known exploited CVE
- Wed 23 SepDay 14
- F5 BIG-IP APM zero-day lets attackers execute code remotely07:36 · SecurityWeek · Known exploited CVE
- F5 Patches Exploited BIG-IP Flaw Allowing Unauthenticated Code Execution18:14 · Security Affairs · Known exploited CVE
- CISA Warns of Active Attacks on Check Point and F5 Flaws21:50 · Security Affairs · Known exploited CVE
- Thu 24 SepDay 21
- Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at Risk03:36 · SecurityOnline · Known exploited CVE
- Fri 25 SepDay 31
- F5 Patches Exploited BIG-IP Zero-Day Enabling Remote Code Execution03:47 · SecurityOnline · Known exploited CVE
Quiet for 3 days
Mon 28 SepDay 62- Nine Flaws Exploited as Attackers Target Edge Products and WordPress02:30 · SecurityOnline · Picked up again · Known exploited CVE
- Check Point Warns of Active Exploits and AI-Powered Attacks14:30 · Check Point · Known exploited CVE