F5 Patches Actively Exploited Zero-Day in BIG-IP APM OAuth Server

F5 has addressed a critical vulnerability in its BIG-IP Access Policy Manager (APM) product that could allow unauthenticated remote code execution (RCE). The flaw, tracked as CVE-2026-94127, affects BIG-IP systems where APM is configured to serve as an OAuth authorization server, issuing access tokens to downstream applications.

According to F5's advisory, the vulnerability stems from improper input validation within the OAuth token issuance process. An attacker who can reach the APM endpoint over the network can exploit this weakness without authenticating, potentially resulting in full system compromise.

F5 disclosed the vulnerability on September 22, 2026, and has since released engineering hotfixes. The company has not released a full software advisory at the time of reporting, but has urged administrators to apply the available patches immediately.

The exploitation of CVE-2026-94127 represents a significant risk for enterprises relying on BIG-IP APM for OAuth-based access management. Organizations with APM deployed as an OAuth authorization server should prioritize patching. F5 has stated that systems where APM is used purely as an access policy engine without OAuth token issuance are not affected.