[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpYpk_k6kX0f3YLK4ORP3du4eKWX88EcOz_GKmqP18Ck":3},{"article":4,"iocs":51,"watch_terms":59,"solutions":60,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"638f3dbd-ef2f-405b-8138-641f16edccc6","F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers","f5-patches-critical-big-ip-apm-zero-day-exploited-for-unauthenticated-rce-on-oau-54af9e","Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes.","Attackers are actively exploiting a critical zero-day vulnerability (CVE-2026-94127) in F5 BIG-IP Access Policy Manager (APM) that allows for unauthenticated remote code execution. The flaw specifically affects systems where APM functions as an OAuth authorization server. F5 has released engineering hotfixes and CISA has added it to its Known Exploited Vulnerabilities catalog, mandating immediate action for federal agencies.","F5 BIG-IP APM zero-day RCE vulnerability exploited in the wild.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Ff5-patches-critical-big-ip-apm-zero-day.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj_ZqCwuuKS7TqNWQ7GpeE07JLzHNn4Jdb2O6iQAlY34SiP2it2VwgmeVm5OjAzoAEHFQRVJENdDNGQL94ibPy1AiB9qkpNxZ3ILA89tYlwqm2OO9tEOH_BZ9HZzObw0nrzszQoKnaCQ-Q8ez5DPsnrKjq40qhm2tu_DhMSFunkVRsHeEIc0IA2NL-yZ5g\u002Fs1600\u002Ff5-zero-day.jpg","2026-09-23T08:29:48+00:00","2026-09-23T10:00:20.780481+00:00",9,[17,20,23,26],{"name":18,"type":19},"BIG-IP APM","product",{"name":21,"type":22},"F5","vendor",{"name":24,"type":25},"OAuth","technology",{"name":27,"type":19},"BIG-IP","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56],{"type":53,"value":54,"context":55},"cve","CVE-2026-94127","Critical zero-day vulnerability in F5 BIG-IP APM",{"type":53,"value":57,"context":58},"CVE-2025-53521","Another APM flaw previously added to CISA's KEV catalog",[21,18,27],{"controls":61,"vendors":148},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":50,"name":121,"problem":122,"products":123},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[149],{"slug":150,"name":21,"logo_path":151,"roles":152},"f5","\u002Fvendor-logos\u002Ff5.png",[153],"affected",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":170},"f5-big-ip-apm-zero-day-enables-unauthenticated-rce-patch-immediately","F5 BIG-IP APM Zero-Day Enables Unauthenticated RCE — Patch Immediately","A critical zero-day vulnerability in F5 BIG-IP Access Policy Manager (CVE-2026-94127) is being actively exploited in the wild, allowing attackers to execute arbitrary code without any authentication on systems where APM is configured as an OAuth authorization server. This is especially dangerous because APM sits at the perimeter of enterprise networks, acting as a gatekeeper for identity and access — meaning a successful exploit can hand attackers the keys to downstream systems. The fact that CISA has added this to its Known Exploited Vulnerabilities (KEV) catalog signals confirmed, real-world exploitation, not just theoretical risk. Organizations that delay patching network appliances — particularly those exposed to the internet — face severe consequences including full network compromise. This incident reinforces that internet-facing infrastructure components require the same (or faster) patch urgency as endpoint operating systems.",[159,160,161,162,163,164,165,166,167,168,169],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST IR-4: Incident Handling","NIST SC-7: Boundary Protection","CISA BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities","ITIL: Change and Release Management (Emergency Change Procedure)","GDPR Article 32: Security of Processing (obligation to patch known vulnerabilities)",{}]