F5 Patches Critical BIG-IP APM Zero-Day Vulnerability

F5 and the Cybersecurity and Infrastructure Security Agency (CISA) have confirmed that threat actors are actively exploiting a critical zero-day vulnerability in the BIG-IP Access Policy Manager (APM).

The flaw, tracked as CVE-2026-94127, carries a CVSS severity score of 9.8. It allows unauthenticated attackers to achieve remote code execution (RCE) by sending malicious traffic to a vulnerable BIG-IP appliance.

F5 discovered the security defect internally and confirmed that exploitation is occurring in the wild. The vulnerability is specifically triggered when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, provided the APM is functioning as an OAuth Authorization Server.

The company clarified that the issue is a data plane matter and does not present a control plane exposure. Systems running in Appliance mode are also susceptible to the flaw.

Affected Versions and Remediation

The vulnerability impacts the following BIG-IP APM versions:

• 21.1.0
• 17.5.0 to 17.5.1
• 17.1.0 to 17.1.3

F5 has released hotfixes to address the vulnerability. Organisations using the affected software should apply these updates immediately to prevent unauthorised access.

CISA Mandates Rapid Patching

Following the disclosure, CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalogue. Under binding operational directive BOD 26-04, US federal agencies are required to patch the vulnerability within three days.