Cybersecurity
F5 patches BIG-IP APM flaw used in attacks
F5 said it released security updates for a BIG-IP APM vulnerability that was already being used in remote code execution attacks, and CISA set a Friday deadline for federal agencies.
- F5 released updates for a BIG-IP APM vulnerability after saying it had been exploited.
- The company said APM deployments used only as an OAuth client or resource server, without OAuth authorisation server profiles, were not affected.
- F5 advised customers to look for repeated OAuth authentication failures, suspicious commands and a TMM SIGABRT, and offered an iRule mitigation for affected servers.
- CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities Catalog and told U.S. federal agencies to secure their networks by Friday.
- Shadowserver said it was tracking more than 14,700 IP addresses with BIG-IP APM fingerprints, but could not tell how many were patched or honeypots.
F5 said in a security advisory that it had learned the vulnerability was being used in attacks and had released fixes for the affected BIG-IP APM product. BIG-IP APM is F5’s access management proxy for networks, applications, cloud services and APIs.
The company said some deployments were outside the affected scope, including those using APM only as an OAuth client or resource server without OAuth authorisation server profiles. It told customers to check for a pattern of multiple OAuth failures, suspicious commands and a TMM SIGABRT.
For administrators who could not patch at once, F5 published mitigation steps that used an iRule on the affected virtual server. Shadowserver said it was tracking more than 14,700 IP addresses with BIG-IP APM fingerprints, but it did not know how many were already patched or were honeypots.
CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities Catalog and ordered U.S. federal agencies to address it by Friday. The agency said vulnerabilities like this were a common route for malicious actors and created risk for federal systems.
Named in this story
Companies
- F5
- released the security updates and said the flaw had been exploited
Organisations
- Shadowserver
- tracked IP addresses with BIG-IP APM fingerprints
Governments and agencies
- Cybersecurity and Infrastructure Security Agency (CISA)
- added the vulnerability to its exploited list and set a Friday deadline for federal agencies
Products and systems
- BIG-IP APM
- the affected access management proxy product, short for Access Policy Manager
- CVE-2026-94127
- the vulnerability identifier added to CISA’s Known Exploited Vulnerabilities Catalog
How the source tells it
Mostly straight security reporting, with urgency coming from the exploitation warning and the Friday remediation deadline.
- urgency the exploit notice and the fixed federal deadline make the response time-sensitive