Browse rankings
All news & advisories
Actively exploited

CVE-2026-94127: Actively Exploited Vulnerability

CVE-2026-94127 CVSS 9.8 CISA KEV · actively exploited
Who it affects
See the summary below.
What to do
Patch immediately — prioritise internet-facing systems.

CVE-2026-94127 - BIG-IP APM OAuth RCE

Severity: CRITICAL (CVSS 9.8)

Status: Actively Exploited (KEV Catalog)

Affected Products:

  • F5 BIG-IP APM (when configured as OAuth Authorization Server)

Vulnerability: Unauthenticated remote code execution via malicious traffic when BIG-IP APM access policy and OAuth profile are configured on a virtual server. Data plane exposure only.

Not Affected:

  • Deployments using APM as OAuth Client/Resource Server without authorization server profiles

Remediation:

  • Consult F5 advisory K000162605 for patched versions and guidance
  • Verify OAuth Authorization Server configuration status
  • Update to supported, patched software version

References:

Data as of September 23, 2026. Sources: nvd.nist.gov, my.f5.com, cisa.gov. Figures are pulled from public vendor and security data and refreshed automatically.
Back to all news & advisories