F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2026-09-23 08:29 UTC
  • Importiert: 2026-09-29 17:07 UTC
  • CVSS: 9.8
  • Quelle-ID: thn_global
  • uid_hash: 54fa30b469b15184fb9c76c26b074e13103eed746970d36c6384068579f18e30
The Hacker News

Inhalt

Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says.

The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes.

Verknuepfte CVEs

CVE-ID Severity (Quelle) CVSS (Quelle) Severity (CVE.org) CVSS (CVE.org) EPSS EPSS-Pctl Veroeffentlicht (CVE.org)

CVE-2026-94127

CRITICAL

9.8

CRITICAL

9.8

0.02226

0.8248

2026-09-22

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
The Hacker News

thn_global

 security_news - de https://feeds.feedburner.com/TheHackersNews
Zurueck zur Eintrags-Liste