importantSYS.SOURCE: The Hacker News• 2026-09-23T13:59:48+05:30

F5 Addresses Critical Zero-Day Vulnerability in BIG-IP APM Allowing Unauthenticated RCE on OAuth Servers

#vulnerability #network security #rce #oauth #f5

F5 has addressed a critical zero-day vulnerability (CVE-2026-94127) in BIG-IP Access Policy Manager (APM), enabling unauthenticated remote code execution (RCE) on systems where APM functions as an OAuth authorization server. The vulnerability, rated 9.8/10 on CVSS, has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, with urgent mitigation recommendations for affected organizations.

Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says.

The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes.

Read original article

*** END OF TRANSMISSION ***

> NETHERLANDS FACES POTENTIAL US SANCTIONS OVER ICC INVESTIGATIONS > STRATEGIC IMPLICATIONS OF ABANDONING SCIENTIFIC LINUX IN HIGH-PERFORMANCE COMPUTING ENVIRONMENTS > F5 ADDRESSES CRITICAL ZERO-DAY VULNERABILITY IN BIG-IP APM ALLOWING UNAUTHENTICATED RCE ON OAUTH SERVERS > CHINESE THREAT ACTORS EXPLOIT CHROME-WINDOWS ZERO-DAY CHAIN FOR CLEANGULP MALWARE DEPLOYMENT > IMPLEMENTING JEV CLASSIFICATION MODEL IN PYTHON > CRITICAL NEXT.JS IMAGERESPONSE VULNERABILITY ENABLES SERVER CODE EXECUTION THROUGH MALICIOUS SVG INPUT > THE 1893 WORLD'S FAIR'S LASTING CULTURAL IMPACT AND HISTORICAL REINTERPRETATIONS > SHINYHUNTERS ALLEGES FBI DATA BREACH INVOLVING AGENT AND APPLICANT INFORMATION > GREECE'S PRIME MINISTER ACKNOWLEDGES CHALLENGES IN ADAPTING TO AI ADVANCEMENTS > GRAMMARLY'S CANCELATION POLICY TRIGGERS AUTOMATED USER NOTIFICATIONS> NETHERLANDS FACES POTENTIAL US SANCTIONS OVER ICC INVESTIGATIONS > STRATEGIC IMPLICATIONS OF ABANDONING SCIENTIFIC LINUX IN HIGH-PERFORMANCE COMPUTING ENVIRONMENTS > F5 ADDRESSES CRITICAL ZERO-DAY VULNERABILITY IN BIG-IP APM ALLOWING UNAUTHENTICATED RCE ON OAUTH SERVERS > CHINESE THREAT ACTORS EXPLOIT CHROME-WINDOWS ZERO-DAY CHAIN FOR CLEANGULP MALWARE DEPLOYMENT > IMPLEMENTING JEV CLASSIFICATION MODEL IN PYTHON > CRITICAL NEXT.JS IMAGERESPONSE VULNERABILITY ENABLES SERVER CODE EXECUTION THROUGH MALICIOUS SVG INPUT > THE 1893 WORLD'S FAIR'S LASTING CULTURAL IMPACT AND HISTORICAL REINTERPRETATIONS > SHINYHUNTERS ALLEGES FBI DATA BREACH INVOLVING AGENT AND APPLICANT INFORMATION > GREECE'S PRIME MINISTER ACKNOWLEDGES CHALLENGES IN ADAPTING TO AI ADVANCEMENTS > GRAMMARLY'S CANCELATION POLICY TRIGGERS AUTOMATED USER NOTIFICATIONS