Confirmed exploitation of a configuration-dependent BIG-IP APM flaw requires organisations to identify OAuth authorisation-server deployments, install engineering hotfixes and investigate pre-patch activity rather than treating version compliance as closure.
What changed
F5 reported active exploitation of CVE-2026-94127, a critical BIG-IP APM heap-based buffer overflow affecting virtual servers that combine an APM access policy with an OAuth profile. On September 22, 2026, the Canadian Centre for Cyber Security said F5 had reported active exploitation of CVE-2026-94127 and published fixed hotfix releases.
Public record through 2026-09-24. Source references count citations across published briefings, including repeated sources. Explore the record and its limits →
What We Publish / What We Sell
D
Free · Public
The Daily
Five evidence-backed selections for security leaders, every weekday.
Security.io scores Exposure from deployability and internet-facing footprint, Urgency from confirmed exploitation and remediation time, and Business Consequence from unauthenticated code execution on an access gateway. Exposure: 92. Urgency: 98. Business consequence: 90. Focus the chart and use the up and down arrow keys for detail. Source: Security.io editorial assessment using the selected Canadian government alert and corroborating reporting; scores are relative 0–100 assessments, not external measurements.