[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRL_1rds6rK7Tg1vyI_o4hrtjHTAO_ZRLfcbylCoNomA":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"76965cce-1fb8-4dd5-ac53-437ed9e57523","Critical F5 BIG-IP Vulnerability Exploited as Zero-Day","critical-f5-big-ip-vulnerability-exploited-as-zero-day-56b3d0","Unauthenticated attackers could send malicious traffic to BIG-IP to achieve remote code execution. The post Critical F5 BIG-IP Vulnerability Exploited as Zero-Day appeared first on SecurityWeek.","F5 has issued a warning that threat actors are actively exploiting a critical vulnerability in its BIG-IP Access Policy Manager (APM) as a zero-day. The flaw, tracked as CVE-2026-94127 with a CVSS score of 9.8, allows unauthenticated attackers to achieve remote code execution when BIG-IP APM is configured with an OAuth profile. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch it within three days.","Critical F5 BIG-IP vulnerability exploited as zero-day, allowing unauthenticated RCE.","https:\u002F\u002Fwww.securityweek.com\u002Fcritical-f5-big-ip-vulnerability-exploited-as-zero-day\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F10\u002FF5-Vulnerability.jpg","2026-09-23T07:34:18+00:00","2026-09-23T08:00:29.621551+00:00",9,[17,20,23,26],{"name":18,"type":19},"BIG-IP APM","product",{"name":21,"type":22},"F5","vendor",{"name":24,"type":25},"OAuth","technology",{"name":27,"type":19},"BIG-IP","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52],{"type":53,"value":54,"context":55},"cve","CVE-2026-94127","Critical F5 BIG-IP APM vulnerability allowing RCE",[21,18,27],{"controls":58,"vendors":144},[59,88,116],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":89,"product_name":113,"url":114,"description":115},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":50,"name":117,"problem":118,"products":119},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[145],{"slug":146,"name":21,"logo_path":147,"roles":148},"f5","\u002Fvendor-logos\u002Ff5.png",[149,150],"affected","reported_by",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":166},"critical-f5-big-ip-zero-day-exploited-in-the-wild-patch-immediately","Critical F5 BIG-IP Zero-Day Exploited in the Wild — Patch Immediately","A critical unauthenticated remote code execution vulnerability (CVE-2026-94127, CVSS 9.8) in F5 BIG-IP Access Policy Manager is being actively exploited as a zero-day, meaning attackers moved faster than defenders could apply patches. The flaw is triggered specifically when the OAuth profile is enabled, highlighting how certain configuration choices can dramatically expand an attack surface. CISA's inclusion in the Known Exploited Vulnerabilities catalog and a three-day federal patching mandate underscore the severity and urgency of the risk. Organizations that lack rapid patch deployment processes or asset visibility for internet-facing appliances are most exposed, and successful exploitation could grant attackers full control over critical network infrastructure.",[156,157,158,159,160,161,162,163,164,165],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 4 – Secure Configuration of Enterprise Assets","NIST SP 800-40 – Guide to Enterprise Patch Management","NIST SI-2 – Flaw Remediation","NIST CM-6 – Configuration Settings","NIST SC-7 – Boundary Protection","CISA KEV Catalog – Known Exploited Vulnerabilities","NIST RA-5 – Vulnerability Monitoring and Scanning","ITIL – Change Management \u002F Emergency Change Procedure",{}]