F5 patches critical BIG-IP APM zero-day exploited for unauthenticated RCE

F5 has patched a critical zero-day in BIG-IP Access Policy Manager, CVE-2026-94127 (CVSS 9.8), already exploited for unauthenticated remote code execution against systems configured as an OAuth authorisation server¹². The heap-based buffer overflow triggers when an APM access policy and an OAuth profile sit on the same virtual server; F5 says it found the bug internally but has confirmed exploitation in the wild, and has shipped hotfixes for the 21.1, 17.5 and 17.1 branches¹².

Restricting access to the management interface does not help here, since the malicious traffic goes straight to the exposed virtual server itself, and systems running in Appliance mode remain vulnerable too². CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 22 September and gave federal agencies until 25 September to remediate under Binding Operational Directive 26-04¹². Neither F5's advisory nor CISA's KEV entry says how many systems were attacked or who is behind it².

Why it matters: OAuth authorisation servers sit at the centre of an organisation's access control, and a flaw this severe, already exploited before a patch existed, gives attackers a direct path to full code execution on infrastructure many networks treat as trusted.