Source: thehackernews.com
A critical zero-day vulnerability (CVE-2026-94127) has been discovered in F5 BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution. The flaw specifically affects BIG-IP systems configured with APM acting as an OAuth authorization server. Attackers are actively exploiting this vulnerability in the wild to execute arbitrary code without authentication. F5 disclosed the vulnerability on September 22 and has released engineering hotfixes to address the issue. The vulnerability is limited to environments where APM is issuing access tokens to applications via OAuth. Organizations using BIG-IP APM in OAuth server mode are urged to apply the hotfixes immediately. The active exploitation status and unauthenticated RCE nature make this a critical-priority patch.
