F5 patches critical zero-day flaw exploited in BIG-IP APM

As outlined in The Register, F5 has released a patch for a critical zero-day vulnerability in its BIG-IP Access Policy Manager (APM) that is actively being exploited by unknown threat actors to achieve remote code execution.

The vulnerability, identified as CVE-2026-94127, is a heap-based buffer overflow affecting BIG-IP APM systems configured as OAuth Authorization Servers with specific access policy and OAuth profile settings. This flaw received a critical CVSS v4.0 score of 9.3. F5 confirmed exploitation in a security advisory, though details on the extent of compromise and whether ransomware was deployed remain undisclosed. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by Friday.

This incident follows a similar warning about a year ago when sophisticated nation-state hackers stole BIG-IP source code and customer data from F5. While the perpetrators of the previous breach were not publicly identified, Google's Mandiant previously linked exploitation of a different F5 BIG-IP flaw (CVE-2023-46747) to UNC5174, an access broker assessed to be operating from China.

Source: The Register