F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

A critical zero-day vulnerability in F5 BIG-IP Access Policy Manager (CVE-2026-94127) is being actively exploited in the wild, allowing attackers to execute arbitrary code without any authentication on systems where APM is configured as an OAuth authorization server. This is especially dangerous because APM sits at the perimeter of enterprise networks, acting as a gatekeeper for identity and access — meaning a successful exploit can hand attackers the keys to downstream systems. The fact that CISA has added this to its Known Exploited Vulnerabilities (KEV) catalog signals confirmed, real-world exploitation, not just theoretical risk. Organizations that delay patching network appliances — particularly those exposed to the internet — face severe consequences including full network compromise. This incident reinforces that internet-facing infrastructure components require the same (or faster) patch urgency as endpoint operating systems.