https://vulnerability.circl.lu/sightings/feed 2026-09-24T15:41:26.792154+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/b6cc5995-a38e-461a-b89d-4c14340878d5/export 2026-09-24T15:41:26.811968+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b6cc5995-a38e-461a-b89d-4c14340878d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/threatcodex/statuses/117326329665895250", "content": "Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)#CVE_2026_94127 https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/", "creation_timestamp": "2026-09-24T13:48:36.215002Z"} 2026-09-24T13:48:36.215002+00:00 https://vulnerability.circl.lu/sighting/f6f7bb9a-9638-4ed2-80e6-12adf8ae59b9/export 2026-09-24T15:41:26.813795+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f6f7bb9a-9638-4ed2-80e6-12adf8ae59b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94127", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwbaaqrejk2c", "content": "F5 BIG-IP APM heap overflow (CVSS 9.8): unauth RCE when an access policy and OAuth profile share a virtual server. actively\u2026 https://0daynews.com/articles/2026-09-23-f5-big-ip-apm-cve-2026-94127-kev-rce/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3422", "creation_timestamp": "2026-09-24T12:15:17.514885Z"} 2026-09-24T12:15:17.514885+00:00 https://vulnerability.circl.lu/sighting/efc7baca-59c6-4f0d-b121-de1a8ba9059d/export 2026-09-24T15:41:26.813954+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "efc7baca-59c6-4f0d-b121-de1a8ba9059d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/forsmile.jp/post/3mwb4hii22k2q", "content": "\u3010\u7dca\u6025\u3011F5 BIG-IP APM \u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\uff08CVE-2026-94127 / CVSS v3.1 9.8 CRITICAL\uff09\n\n\u8a8d\u8a3c\u306a\u3057\u3067\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u307e\u3067\u5c4a\u304d\u30019\u670822\u65e5\u306bCISA\u306eKEV\u3078\u8ffd\u52a0\u3055\u308c\u307e\u3057\u305f\u3002\u5bfe\u5fdc\u671f\u9650\u306f9\u670825\u65e5\u3067\u3059\u3002\n\u5f71\u97ff\u3059\u308b\u306e\u306f\u300cOAuth\u8a8d\u53ef\u30b5\u30fc\u30d0\u300d\u3068\u3057\u3066\u69cb\u6210\u3057\u305f\u5834\u5408\u3060\u3051\u3067\u3001OAuth\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u5c02\u7528\u306a\u3089\u5bfe\u8c61\u5916\u3067\u3059\u3002\nCISA\u306f\u30d1\u30c3\u30c1\u524d\u306e\u30d5\u30a9\u30ec\u30f3\u30b8\u30c3\u30af\u8abf\u67fb\u3092\u6c42\u3081\u3066\u3044\u307e\u3059\u3002\n\nforsmile.jp/articles/f5-...", "creation_timestamp": "2026-09-24T11:07:27.059318Z"} 2026-09-24T11:07:27.059318+00:00 https://vulnerability.circl.lu/sighting/4cfa6387-8a97-4c16-8385-8bc53bb45593/export 2026-09-24T15:41:26.814120+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4cfa6387-8a97-4c16-8385-8bc53bb45593", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/9/f5-big-ip-apm-rce", "content": "24. September 2026\n\nBeschreibung\n\nIn der OAuth Komponente von F5 BIG-IP APM existiert eine kritische Schwachstelle, welche dass unauthentifizierte Ausführen von Schadcode aus der Ferne erlaubt. Betroffen sind Systeme, welche BIG-IP APM als Authorisierungsserver via OAuth-Funktionalität nutzen.\n\nEs liegen Informationen vor, dass diese Lücke bereits aktiv ausgenutzt wird, daher empfiehlt sich die Überprüfung der eigenen Instanzen auf etwaige Indicators of Compromise, welche ebenfalls im veröffentlichten Advisory enthalten sind.\n\nCVE-Nummer(n): CVE-2026-94127\n\nCVSS v4.0 Base Score: 9.3\n\nAuswirkungen\n\nAngreiferInnen können die Lücke durch setzen eines zu langen Authorization-Headers trivial ausnutzen. Die Ausnutzung der Lücke, mithilfe einer speziell präparierten Anfrage, führt zur unauthentifizierten Ausführung von Befehlen.\n\nBetroffene Systeme\n\n\n\nBIG-IP APM\n\n\n\nVersion 21.1.0\n\n\n\nBIG-IP APM\n\n\n\nVersion 17.5.0 - 17.5.1\n\nVersion 17.1.0 - 17.1.3\n\n\n\n\nAbhilfe\n\nF5 stellt Hotfixes bereit, die die Sicherheitslücke schließen. Sollten Updates nicht zeitnahe eingespielt werden können, empfiehlt F5 zur zwischenzeitlichen Mitigation das Erstellen einer iRule welche über den Support bezogen werden kann.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nK000162605: BIG-IP APM vulnerability CVE-2026-94127https://my.f5.com/manage/s/article/K000162605\n\nIs This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/", "creation_timestamp": "2026-09-24T11:04:47.000000Z"} 2026-09-24T11:04:47+00:00 https://vulnerability.circl.lu/sighting/e00ab5b5-f1af-4945-a5dd-6ec64b686bb5/export 2026-09-24T15:41:26.814284+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e00ab5b5-f1af-4945-a5dd-6ec64b686bb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwb42edqjw2k", "content": "\ud83d\udce2 CVE-2026-94127 : Vuln\u00e9rabilit\u00e9 critique F5 BIG-IP APM exploit\u00e9e en zero-day\n\nSecurityWeek, article de Ionut Arghire publi\u00e9 le 23 septembre 2026. F5 et la CISA ont \u00e9mis conjointement une alerte concernant l'exploitation active d'une\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#APM #F5BIGIP #Cyberveille", "creation_timestamp": "2026-09-24T11:00:07.170009Z"} 2026-09-24T11:00:07.170009+00:00 https://vulnerability.circl.lu/sighting/a8fda39e-6bf0-4bd9-9e4c-f58f63e073ed/export 2026-09-24T15:41:26.814410+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a8fda39e-6bf0-4bd9-9e4c-f58f63e073ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3mwb3evijlg24", "content": "[RSS] Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)\n\n\n labs.watchtowr.com -> \n\n\nOriginal->", "creation_timestamp": "2026-09-24T10:48:07.162098Z"} 2026-09-24T10:48:07.162098+00:00 https://vulnerability.circl.lu/sighting/cf787947-4256-483f-ac34-4bc5f188980a/export 2026-09-24T15:41:26.814530+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "cf787947-4256-483f-ac34-4bc5f188980a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mwaxljnbxj2a", "content": "\uff1e \u6ce8\u610f\u559a\u8d77: F5 BIG-IP Access Policy Manager\u306b\u304a\u3051\u308b\u30d2\u30fc\u30d7\u30d9\u30fc\u30b9\u306e\u30d0\u30c3\u30d5\u30a1\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027\uff08CVE-2026-94127\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260028.html\n", "creation_timestamp": "2026-09-24T09:40:14.693276Z"} 2026-09-24T09:40:14.693276+00:00 https://vulnerability.circl.lu/sighting/01df1ce6-c4a1-4f66-9c9e-ec94f2c54153/export 2026-09-24T15:41:26.814658+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "01df1ce6-c4a1-4f66-9c9e-ec94f2c54153", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mwas2timvx2f", "content": "\u6ce8\u610f\u559a\u8d77: F5 BIG-IP Access Policy Manager\u306b\u304a\u3051\u308b\u30d2\u30fc\u30d7\u30d9\u30fc\u30b9\u306e\u30d0\u30c3\u30d5\u30a1\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027\uff08CVE-2026-94127\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77\n\nF5\u306eBIG-IP APM\u306b\u304a\u3044\u3066\u30d2\u30fc\u30d7\u30d9\u30fc\u30b9\u306e\u30d0\u30c3\u30d5\u30a1\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u8106\u5f31\u6027\uff08CVE-2026-94127\uff09\u304c\u5831\u544a\u3055\u308c\u307e\u3057\u305f\u3002OAuth Authorization Server\u3068\u3057\u3066\u69cb\u6210\u3055\u308c\u305fAPM\u3067\u3001\u8a8d\u8a3c\u306a\u3057\u306e\u30ea\u30e2\u30fc\u30c8\u653b\u6483\u8005\u304c\u4efb\u610f\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u307e\u3059\u3002\u65e2\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u304a\u308a\u3001\u5f71\u97ff\u3092\u53d7\u3051\u308b\u30d0\u30fc\u30b8\u30e7\u30f3\u306fBIG-IP APM 21.1.0\u53ca\u307317.5.0-17.5.1\u300117.\u2026\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-09-24T08:01:26.036977Z"} 2026-09-24T08:01:26.036977+00:00 https://vulnerability.circl.lu/sighting/716f430b-58fb-46e8-9f0d-5ba01f1f1c53/export 2026-09-24T15:41:26.814787+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "716f430b-58fb-46e8-9f0d-5ba01f1f1c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mwarymr6ol23", "content": "F5 confirms exploitation of CVE-2026-94127 (CVSS 9.8): unauth RCE in BIG-IP APM's OAuth Authorization Server role. CISA KEV same day, deadline Friday. 14,700+ exposed IPs. Patch or apply F5's interim \n\ud83c\uddec\ud83c\udde7 diesec.com/2026/09/f5-b...\n\ud83c\udde9\ud83c\uddea diesec.com/de/2026/09/f... \n#cybersecurity", "creation_timestamp": "2026-09-24T08:00:12.125145Z"} 2026-09-24T08:00:12.125145+00:00 https://vulnerability.circl.lu/sighting/6e5a9111-cfbd-4e5f-974a-fa8713e42c3c/export 2026-09-24T15:41:26.814918+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6e5a9111-cfbd-4e5f-974a-fa8713e42c3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwanmp5ywy2a", "content": "Top 3 CVE for last 7 days:\nCVE-2026-86296: 25 interactions\nCVE-2026-7273: 20 interactions\nCVE-2026-58704: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-94127: 10 interactions\nCVE-2026-69836: 7 interactions\nCVE-2026-87902: 7 interactions\n", "creation_timestamp": "2026-09-24T06:41:57.580100Z"} 2026-09-24T06:41:57.580100+00:00