23 September 2026
Reference: CVE-2026-94127
1. What is being reported?
The report describes a critical vulnerability in F5 BIG-IP APM, a device used to manage secure access to networks. When configured as an OAuth Authorization Server, certain malicious traffic can exploit this flaw to execute harmful commands remotely. This does not affect setups using BIG-IP APM only as an OAuth Client or Resource Server.
2. What this means in plain English
If your organisation uses F5 BIG-IP APM as an OAuth Authorization Server, attackers could take control of your system without any authentication. This could lead to data breaches, service disruption, or further attacks on your network. The risk is high because the flaw is actively being exploited by attackers.
3. Could this affect a small business?
Small businesses or charities that use F5 BIG-IP APM configured as an OAuth Authorization Server could be affected. Those using the device only as an OAuth Client or Resource Server, or not using BIG-IP APM at all, are unlikely to be impacted.
4. What to do now
- Check if your organisation uses F5 BIG-IP APM as an OAuth Authorization Server.
- Contact your IT provider or F5 support immediately to confirm if your version is vulnerable and to get the latest security updates or mitigations.
- Apply all recommended patches or mitigations from F5 without delay.
- Review your system’s internet exposure and follow any guidance on prioritising security updates.
5. Ask your IT provider
Can you confirm if our F5 BIG-IP APM is configured as an OAuth Authorization Server and if it is affected by CVE-2026-94127? What steps are being taken to protect us?
6. Bottom line
If you use F5 BIG-IP APM as an OAuth Authorization Server, act quickly to apply security updates to prevent attackers from taking control remotely.
Information based on CISA KEV, NVD and multiple reputable security reports.