Skip to content
OriginalSign in

CISA KEV alertCyberSIXT

CISA Warns of Active Attacks Exploiting Critical F5 BIG-IP Flaw

Part of the CVE-2026-94127 story · since 22 Sep

Quiet for 6 weekslast report 28 Sep10 articles6 outlets
22 Sep · SecurityOnline first17 Oct25 OctNowThis article2nd of 10
  • Tue 22 Sep, 18:01 UTC. SecurityOnline, first report. F5 Warns Hackers Are Exploiting Critical BIG-IP APM Flaw. Cites a CVE in CISA KEV.
  • Tue 22 Sep, 20:31 UTC. CISA, its first report on the story. CISA Warns of Active Attacks Exploiting Critical F5 BIG-IP Flaw. Cites a CVE in CISA KEV. This article, 2nd of 10.
  • Wed 23 Sep, 07:36 UTC. SecurityWeek, its first report on the story. F5 BIG-IP APM zero-day lets attackers execute code remotely. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 09:59 UTC. Rapid7, its first report on the story. F5 BIG-IP Flaw Enables Unauthenticated Remote Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 18:14 UTC. Security Affairs, its first report on the story. F5 Patches Exploited BIG-IP Flaw Allowing Unauthenticated Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 21:50 UTC. Security Affairs. CISA Warns of Active Attacks on Check Point and F5 Flaws. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 03:36 UTC. SecurityOnline. Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at Risk. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 03:47 UTC. SecurityOnline. F5 Patches Exploited BIG-IP Zero-Day Enabling Remote Code Execution. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline. Nine Flaws Exploited as Attackers Target Edge Products and WordPress. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. Check Point, its first report on the story. Check Point Warns of Active Exploits and AI-Powered Attacks. Cites a CVE in CISA KEV.

CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalogue on 22 September 2026. The vulnerability affects F5 BIG-IP APM and is a heap-based buffer overflow that can enable unauthenticated remote code execution when an access policy and OAuth profile are configured on a virtual server.

The flaw is a heap-based buffer overflow in the BIG-IP APM component. An unauthenticated attacker may exploit it remotely to execute code on an affected system. The vulnerability has a CVSS score of 9.8 and is rated Critical. The patch status is unknown. F5 has provided a temporary mitigation iRule and advises installing the final vendor patch as soon as possible.

CISA’s KEV listing confirms that attackers are actively exploiting this vulnerability. The available data does not confirm ransomware campaign use. Federal Civilian Executive Branch (FCEB) agencies must remediate the vulnerability by 25 September 2026. The short deadline reflects the risk associated with internet-exposed BIG-IP APM deployments.

CISA requires organisations to apply mitigations in accordance with F5’s vendor instructions, while complying with BOD 26-04 and CISA’s Forensics Triage Requirements. Organisations should apply the vendor-provided iRule to support proactive forensic triage, then install the final vendor patch as soon as possible. If mitigations are unavailable, applicable BOD 26-04 guidance requires organisations to discontinue use of the product. FCEB agencies are directly affected, but all organisations should review their exposure and patching status.

Consult the NVD entry and CISA KEV catalogue for full details.

How the story developed

All 10 articles
Quiet for 6 weekslast report 28 Sep10 articles6 outlets

10 articles from 6 outlets since 22 Sep. Quiet since 28 Sep. This was the 2nd report, 2 hours after the first.

Now22 Sep242526272829First reportSecurityOnline · 22 Sep, 18:01
  • Tue 22 Sep, 18:01 UTC. SecurityOnline, first report. F5 Warns Hackers Are Exploiting Critical BIG-IP APM Flaw. Cites a CVE in CISA KEV.
  • Tue 22 Sep, 20:31 UTC. CISA, its first report on the story. CISA Warns of Active Attacks Exploiting Critical F5 BIG-IP Flaw. Cites a CVE in CISA KEV. This article, 2nd of 10.
  • Wed 23 Sep, 07:36 UTC. SecurityWeek, its first report on the story. F5 BIG-IP APM zero-day lets attackers execute code remotely. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 09:59 UTC. Rapid7, its first report on the story. F5 BIG-IP Flaw Enables Unauthenticated Remote Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 18:14 UTC. Security Affairs, its first report on the story. F5 Patches Exploited BIG-IP Flaw Allowing Unauthenticated Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 21:50 UTC. Security Affairs. CISA Warns of Active Attacks on Check Point and F5 Flaws. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 03:36 UTC. SecurityOnline. Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at Risk. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 03:47 UTC. SecurityOnline. F5 Patches Exploited BIG-IP Zero-Day Enabling Remote Code Execution. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline. Nine Flaws Exploited as Attackers Target Edge Products and WordPress. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. Check Point, its first report on the story. Check Point Warns of Active Exploits and AI-Powered Attacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 10 articles as a list
  1. Tue 22 SepDay 02
    1. F5 Warns Hackers Are Exploiting Critical BIG-IP APM Flaw18:01 · SecurityOnline · First report · Known exploited CVE
    2. CISA Warns of Active Attacks Exploiting Critical F5 BIG-IP Flaw20:31 · CISA · official · CISA alert · Known exploited CVE · This article, 2nd of 10
  2. Wed 23 SepDay 14
    1. F5 BIG-IP APM zero-day lets attackers execute code remotely07:36 · SecurityWeek · Known exploited CVE
    2. F5 BIG-IP Flaw Enables Unauthenticated Remote Code Execution09:59 · Rapid7 · Known exploited CVE
    3. F5 Patches Exploited BIG-IP Flaw Allowing Unauthenticated Code Execution18:14 · Security Affairs · Known exploited CVE
    4. CISA Warns of Active Attacks on Check Point and F5 Flaws21:50 · Security Affairs · Known exploited CVE
  3. Thu 24 SepDay 21
    1. Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at Risk03:36 · SecurityOnline · Known exploited CVE
  4. Fri 25 SepDay 31
    1. F5 Patches Exploited BIG-IP Zero-Day Enabling Remote Code Execution03:47 · SecurityOnline · Known exploited CVE

  5. Quiet for 3 days

    Mon 28 SepDay 62
    1. Nine Flaws Exploited as Attackers Target Edge Products and WordPress02:30 · SecurityOnline · Picked up again · Known exploited CVE
    2. Check Point Warns of Active Exploits and AI-Powered Attacks14:30 · Check Point · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in