F5 BIG-IP APM zero-day exploited in wild
An actively exploited zero-day heap overflow in F5 BIG-IP Access Policy Manager allows unauthenticated remote code execution when OAuth is configured on a virtual server.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-94127 as exploited in the wild.
NCSC-NL has issued a high-priority advisory for CVE-2026-94127, a heap-based buffer overflow in F5 Networks BIG-IP Access Policy Manager (APM). The vulnerability allows an unauthenticated attacker to execute arbitrary code by sending crafted network traffic to a vulnerable system. Affected systems are those with both an access policy and an OAuth profile configured on the virtual server. F5 has confirmed this is a zero-day vulnerability that is being actively exploited in the wild, and has assigned it a CVSS v4 score of 9.3.
F5 has released security updates addressing the flaw along with indicators of compromise (IOCs). NCSC-NL strongly advises organizations to check vulnerable systems for the published IOCs before applying patches, given the ongoing active exploitation, and to prioritize this check and remediation as soon as possible. For organizations unable to apply updates immediately, F5 has published alternative mitigating measures. Defenders should consult F5's own advisory for the IOCs and detailed mitigation guidance, and treat any BIG-IP APM instance with OAuth-enabled access policies as high-risk until patched or verified clean.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0386.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs