F5 Patches Actively Exploited BIG-IP APM Flaw (CVE-2026-94127)
Updated Published by Kishan Prajapat, SEO & Content Lead
Drafted with Citeya, an AI writing tool built by KPThink.
F5 has released hotfixes for CVE-2026-94127, a critical flaw in BIG-IP Access Policy Manager (APM) that attackers are exploiting, according to The Hacker News. CISA added it to its Known Exploited Vulnerabilities catalog on 22 September 2026.
What’s affected
The flaw is a heap-based buffer overflow rated 9.8 (CVSS v3.1) and 9.3 (CVSS v4.0). It affects BIG-IP APM where an APM access policy and an OAuth authorization server profile are configured on the same virtual server. Affected branches are 21.1 (21.1.0 before the hotfix), 17.5 (17.5.0 to 17.5.1) and 17.1 (17.1.0 to 17.1.3).
What to do
Install F5’s engineering hotfix for your branch. If you can’t patch straight away, F5 provides an iRule mitigation for the affected virtual server. Because the flaw is already being exploited, treat unpatched systems configured this way as potentially compromised: review logs for unusual requests to OAuth endpoints and unexpected outbound connections, and rotate OAuth signing keys if anything looks wrong. US federal agencies had until 25 September to act.
Why edge devices keep showing up in these alerts
Load balancers and access gateways sit on the internet by design and often hold session tokens and keys, which makes them valuable targets. Know which of your devices expose management or authentication endpoints: a port scan of your public IPs and a check of their response headers is a quick start.
Check What Your Edge Devices Expose
Scan a public IP to see which common TCP ports are open to the internet.
Run a Port ScanSpotted a mistake? Tell usand we'll correct it.
Related Articles
Network IP Ranges and Blocks Explained
Discover how network IP ranges and blocks work, why they're essential for cybersecurity, and real-world examples to help you manage your network better.
Proxy Networks and WAN Security: Risks and Precautions
Understand how a proxy approach works and why you need to be cautious when using proxy services. Learn from real-world examples and protect your data.
Public IP Security: A Practical Network Security Guide
Master public IP security with the latest trends, expert insights, and practical steps to protect your digital world in 2026.
What Is a Public IP Address? How to Find and Protect Yours
What a public IP address is, why it matters for privacy and security, and how to find and protect yours.