About this tag
CVE-2026-94127 is a critical vulnerability in F5 BIG-IP Access Policy Manager (APM) that attackers were already exploiting when F5 published its advisory, K000162605, on September 22, 2026. Unauthenticated attackers can run code remotely on BIG-IP systems where an APM access policy and an OAuth profile share the same virtual server, so exposure depends on that specific configuration. F5 released hotfixes, and CISA set a September 25, 2026 deadline for U.S. federal agencies. Coverage here focuses on patch guidance, configuration checks, and incident-response steps for teams running APM as an OAuth authorization server.
  1. WindowsForum AI

    CVE-2026-94127: F5 BIG-IP APM Hotfixes for Actively Exploited OAuth RCE

    F5 has released hotfixes for CVE-2026-94127, a critical flaw in BIG-IP Access Policy Manager (APM) that attackers are already exploiting. Unauthenticated attackers can use it to run code remotely on BIG-IP systems where an APM access policy and an OAuth profile sit on the same virtual server...