{"vulnerability": "cve-2026-94127", "sightings": [{"uuid": "b081eb86-eed1-4d77-ae79-9ee822670195", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117315296004023098", "content": "We have just added an important vulnerability affecting F5 BIG-IP (CVE-2026-94127) https://vuldb.com/vuln/408460", "creation_timestamp": "2026-09-22T15:02:36.064494Z"}, {"uuid": "bdb67c2c-f0f0-4143-94da-d218ca2277b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117315299719177302", "content": "EITW 0day in F5 APM. \nhttps://my.f5.com/manage/s/article/K000162605\n\nWhen a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). (CVE-2026-94127)", "creation_timestamp": "2026-09-22T15:03:33.129967Z"}, {"uuid": "4084953d-c5cf-47f1-8ebc-f57214c40d27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw4jnh4myv2t", "content": "CVE-2026-94127 - big-ip\nWhen an access policy and an OAuth profile are set up on a BIG-IP APM virtual server, a specially crafted request can cause the system to execute attacker-controlled code. This can be done\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bigip #f5 #CVE #infosec", "creation_timestamp": "2026-09-22T15:20:07.576886Z"}, {"uuid": "fcd0f8e6-9262-41c4-8f2e-8a32c8d6751a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw4md75pfc2f", "content": "\ud83d\udea8 CVE-2026-94127 \u2014 CVSS 9.3 CRITICAL\n\nWhen a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-94127\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-22T16:08:04.896994Z"}, {"uuid": "2e074ab2-2058-4579-beed-ebb4118feb5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mw4mnrgsus2x", "content": "BIG-IP APM vulnerability CVE-2026-94127\n\n#critical #9.8\n\nmy.f5.com/manage/s/art...", "creation_timestamp": "2026-09-22T16:14:05.761440Z"}, {"uuid": "47440301-cc9b-48a5-881d-f2f1550e2de2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.acn.gov.it/portale/w/f5-big-ip-rilevato-sfruttamento-in-rete-della-cve-2026-94127", "content": "", "creation_timestamp": "2026-09-22T16:15:42.643792Z"}, {"uuid": "a9792aeb-67c8-42de-959d-b74f85d867d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/f5-security-advisory-av26-949", "content": "", "creation_timestamp": "2026-09-22T16:15:45.770106Z"}, {"uuid": "b8aa5b98-dd3d-4051-b70a-68ce0f2f85c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mw4nfzq6r42o", "content": "An exploited BIG-IP APM vulnerability tracked as CVE-2026-94127 allows RCE attacks. Secure your BIG-IP APM vulnerability deployments with new F5 hotfixes.\n\n#F5 #BIGIP #CVE202694127 #Cybersecurity #InfoSec #RCE #Vulnerability", "creation_timestamp": "2026-09-22T16:27:34.721824Z"}, {"uuid": "fb785347-9732-4b5d-a46a-50f6106f38d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-28", "content": "", "creation_timestamp": "2026-09-22T16:45:29.188076Z"}, {"uuid": "22381306-b552-41a8-9048-1d646f7a562c", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f7dd33c2-03c3-4ff2-9f9f-66474c7f9169", "content": "", "creation_timestamp": "2026-09-22T20:00:03.436422Z"}, {"uuid": "8d4a02f5-c742-49aa-8fbf-61da1ef13676", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://gist.github.com/ichintu/36aaaecfd03b65cd834e3e2ec1b2ba36", "content": "This daily cyber threat intelligence digest highlights critical vulnerabilities, active exploits, and emerging security guidance. Key advisories include default credential exposure in HPE ALE (CVE-2026-76708, CVSS 9.8), an actively exploited heap overflow in F5 BIG-IP APM (CVE-2026-94127), and a DoS flaw in Vector/Logstash (CVE-2026-77620). Additional affected platforms include Erlang OTP and MikroTik RouterOS, with patches and hotfixes available. On the threat actor front, a malicious npm package disguised as a Twilio tool is harvesting credentials, while a new zero-day PoC (BigDiskBuster) disrupts Microsoft Defender updates by exhausting disk space. The digest also features technical analysis of MikroTik disclosures, an open-source architecture for offline clinic ID verification, and a practical guide on avoiding false-positive RCE reports by validating delays with control requests and computed outputs rather than relying on time-based checks. Organizations are urged to apply vendor updates, monitor for credential exfiltration, and strengthen vulnerability validation practices.", "creation_timestamp": "2026-09-22T20:01:40.607492Z"}, {"uuid": "95992178-9b02-4f06-a734-822b62bb9479", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mw4zjbl7p42w", "content": "\ud83d\uded1 CVE-2026-94127\nF5 BIG-IP APM\nCVSS 9.3 / KEV: No\nTL;DR: When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malici\u2026\nhttps://cvesentinel.com/report/CVE-2026-94127?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-22T20:04:07.348978Z"}, {"uuid": "bebe691d-a271-4595-a024-ef157e182b09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-022-vulnerability-impacting-f5-big-ip-access-policy-manager-apm-cve-2026-94127", "content": "", "creation_timestamp": "2026-09-22T20:15:06.583173Z"}, {"uuid": "711a37ca-cb19-4659-887c-bb62d98f2416", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mw52zat6a522", "content": "CVE-2026-94127 now in CISA KEV.\nActively exploited F5 BIG-IP APM zero-day.\n\u2022 Heap-based buffer overflow\n\u2022 CVSS v4 9.3\n\nhttps://thecircuitry.to/article/cisa-adds-actively-exploited-f5-big-ip-apm-flaw-to-kev-catalog-mud3ryl7", "creation_timestamp": "2026-09-22T20:30:57.797508Z"}, {"uuid": "e48c809d-fcef-4daa-b73c-5ecdefce2728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94127", "type": "seen", "source": "https://infosec.exchange/ap/users/115741367687413652/statuses/117316666030287896", "content": "When it rains, it pours. F5 BIG-IP APM also has an exploited CVE!\nhttps://ifin.network/t/f5-big-ip-cve-2026-94127-rce-exploited/855\n#ThreatIntel #ThreatIntelligence #IFIN", "creation_timestamp": "2026-09-22T20:51:56.250402Z"}, {"uuid": "9dabcb2e-bccf-4b4f-acca-641c4616d388", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mw55z2eriz2v", "content": "K000162605: BIG-IP APM vulnerability CVE-2026-94127", "creation_timestamp": "2026-09-22T21:24:31.669335Z"}, {"uuid": "6ad342bf-e405-452e-a9d0-42c962aac599", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mw5ddlqbs32c", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-94127", "creation_timestamp": "2026-09-22T22:59:54.507060Z"}, {"uuid": "0203d3b3-e404-4dbb-9d74-5b86cf61c98f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.acn.gov.it/portale/w/f5-big-ip-rilevato-sfruttamento-in-rete-della-cve-2026-94127", "content": "Rilevato lo sfruttamento in rete di una vulnerabilit\u00e0, identificata tramite la CVE-2026-94127, presente in BIG-IP APM. Tale vulnerabilit\u00e0, qualora sfruttata, potrebbe consentire a utenti malintenzionati remoti di eseguire codice arbitrario sui sistemi interessati.", "creation_timestamp": "2026-09-23T01:00:44.451949Z"}, {"uuid": "06987729-8c70-457c-872f-cfe749649d3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mw5uc2gdc22c", "content": "~Certeu~\nActively exploited unauthenticated RCE affects BIG-IP APM; patch urgently.\n-\nIOCs: CVE-2026-94127\n-\n#CVE202694127 #F5 #ThreatIntel", "creation_timestamp": "2026-09-23T04:03:16.780522Z"}, {"uuid": "e28cf65a-a056-4beb-9b4c-07d1152d50d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/f5-big-ip-remote-code-execution-vulnerability_20260923", "content": "", "creation_timestamp": "2026-09-23T04:48:28.572197Z"}, {"uuid": "6ef3a239-d040-4ab4-9545-a30b603794ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mw5xliytoj2d", "content": "Daily IT Security Digest \u2014 2026-09-23\nconcerning because attackers now possess proprietary code that could reveal previously unknown vulnerabilities (0-days) in widely deployed F5 appliances. CVE-2026-94127 (RCE) and CVE-2026-93616 (Check Point RCE) are among the newly exposed concerns.", "creation_timestamp": "2026-09-23T05:02:14.474200Z"}, {"uuid": "4662e55a-82f2-4849-a54f-b5c7f9f20f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mw64jmd4zl2x", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-94127: \u26a0\ufe0f CVE-2026-94127: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-94127-when-a-big-ip-apm-access-policy", "creation_timestamp": "2026-09-23T06:30:39.853250Z"}, {"uuid": "865c5200-c8de-418f-97b0-193d336080ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://t.me/infosec_ita_notizie/4103", "content": "\u2615 CYBERBRIEFING \u2014 Mercoled\u00ec 23 settembre 2026\n\n\u2615 CYBERBRIEFING \u2014 Mercoled\u00ec 23 settembre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \ud83d\udd34 IN PRIMO PIANO Zero-day critico su F5 BIG-IP APM: attacchi gi\u00e0 in corso, controllo remoto senza autenticazione \u00c8 stata scoperta una vulnerabilit\u00e0 zero-day (CVE-2026-94127) nel modulo\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-09-23\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "creation_timestamp": "2026-09-23T07:00:04.913530Z"}, {"uuid": "35eaeff4-de78-4797-a43e-4e29c47e15f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117319180197500080", "content": "CVE-2026-94127: Critical zero-day in F5 BIG-IP APM exploited for RCE on OAuth Authorization Servers. Patch urgently or use F5's iRule mitigation. Monitor for OAuth auth failures and TMM SIGABRTs. https://radar.offseq.com/threat/f5-patches-big-ip-apm-zero-day-flaw-exploited-in-rce-attacks-191545153729ae57 #OffSeq #F5 #ZeroDay #RCE #Vuln", "creation_timestamp": "2026-09-23T07:30:24.335193Z"}, {"uuid": "5a8950c7-c68f-44c2-8d6c-723345d82de2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mw67ui7bwn24", "content": "CVE-2026-94127 is a CRITICAL zero-day in F5 BIG-IP APM (OAuth Authorization Servers) with active RCE exploitation. Patch now or apply iRule mitigation. https://radar.offseq.com/threat/f5-patches-big-ip-apm-zero-day-flaw-exploited-in-rce-attacks-191545153729ae57 #OffSeq #F5 #ZeroDay", "creation_timestamp": "2026-09-23T07:30:26.375193Z"}, {"uuid": "1a9aef27-f7cf-49a5-8125-c6747fa1f486", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mw6albhwba2q", "content": "Threat actors exploit CVE-2026-94127 in BIG-IP APM OAuth Authorization Server setups to gain unauthenticated remote code execution, prompting urgent patching.\n", "creation_timestamp": "2026-09-23T07:43:11.240344Z"}, {"uuid": "01ad886a-8c42-4f43-8e68-89ea4a5a1984", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mw6am2mdk524", "content": "Threat actors exploit CVE-2026-94127 in BIG-IP APM OAuth Authorization Server setups to gain unauthenticated remote code execution, prompting urgent patching.\n", "creation_timestamp": "2026-09-23T07:43:37.227473Z"}, {"uuid": "1f8ee877-8af5-454d-b049-debe18f3c851", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/bsi.bund.de/post/3mw6c33ncus2e", "content": "\ud83d\udce2\u2757\ufe0f Der Hersteller F5 ver\u00f6ffentlichte ein Advisory zu einer ausgenutzten Zero-Day Schwachstelle in seinem Produkt BIG-IP Access Policy Manager (APM) zur sicheren Zugriffsteuerung und Anwendungszugriff: CVE-2026-94127, CVSS-Score 9.8/10 (\"kritisch\")\n\n\ud83d\udc49\ufe0f https://www.bsi.bund.de/dok/1209384", "creation_timestamp": "2026-09-23T08:09:55.875164Z"}, {"uuid": "1961f4c2-751f-4082-b16c-87dac765c37b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://social.bund.de/users/bsi/statuses/117319335561645833", "content": "Der Hersteller F5 ver\u00f6ffentlichte ein Advisory zu einer ausgenutzten Zero-Day Schwachstelle in seinem Produkt BIG-IP Access Policy Manager (APM) zur sicheren Zugriffsteuerung und Anwendungszugriff: CVE-2026-94127, CVSS-Score 9.8/10 (\"kritisch\")\nF5 gibt an, dass die Schwachstelle bereits aktiv ausgenutzt wird. IT-Sicherheitsverantwortliche sollten unverz\u00fcglich die Patchst\u00e4nde pr\u00fcfen und, sofern erforderlich, die verf\u00fcgbaren Engineering Hotfixes einspielen.\n\ud83d\udc49\ufe0f https://www.bsi.bund.de/dok/1209384", "creation_timestamp": "2026-09-23T08:10:40.959112Z"}, {"uuid": "93c75043-f0b4-468b-9fca-356ea9181f29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117319383133736126", "content": "Our CTI team identified a lot of activities targeting F5 BIG-IP (CVE-2026-94127) https://vuldb.com/vuln/408460/cti", "creation_timestamp": "2026-09-23T08:22:00.816361Z"}, {"uuid": "f6c2f916-b0f9-4859-a6eb-f70233a4f812", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mw6dtt2nc22o", "content": "CVE-2026-94127 enables unauthenticated remote code execution on F5 BIG-IP APM when APM functions as an OAuth authorization server, requiring hotfixes.\n", "creation_timestamp": "2026-09-23T08:41:39.651828Z"}, {"uuid": "c5f651c2-ec65-40c7-89ed-f5d6698fa9e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mw6dvnpyed2y", "content": "CVE-2026-94127 enables unauthenticated remote code execution on F5 BIG-IP APM when APM functions as an OAuth authorization server, requiring hotfixes.\n", "creation_timestamp": "2026-09-23T08:42:40.477831Z"}, {"uuid": "2064faa7-ed52-4dc1-b797-cd385d3aaf87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mw6dvpccpn2o", "content": "CVE-2026-94127 enables unauthenticated remote code execution on F5 BIG-IP APM when APM functions as an OAuth authorization server, requiring hotfixes.\n", "creation_timestamp": "2026-09-23T08:42:42.374459Z"}, {"uuid": "e2ea3eab-bd79-4d65-bcde-74cfe4da2509", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mw6fojcw7a2w", "content": "\ud83e\udd16 CVE-2026-94127: critical F5 BIG-IP APM zero-day exploited in the wild for unauthRCE. Affects systems where APM acts as OAuth auth server. Hotfixes released.\nhttps://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html", "creation_timestamp": "2026-09-23T09:14:27.834775Z"}, {"uuid": "a4688ebb-0090-4834-aea0-82a199986568", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2078", "content": "", "creation_timestamp": "2026-09-23T09:51:03.175368Z"}, {"uuid": "eb04c615-d58c-494c-aa37-e40a07a748a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html", "content": "Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says.\n\nThe flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September 22 and has released engineering hotfixes.", "creation_timestamp": "2026-09-23T10:00:51.996183Z"}, {"uuid": "6c7e20e0-25b1-4573-9b41-16a4eb6e8152", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mw6j3go3bv2l", "content": "F5 and CISA say CVE-2026-94127, a critical BIG-IP APM flaw with CVSS 9.8, is being used as a zero-day for unauthenticated remote code execution. Hotfixes are available. #F5 #BIGIPAPM #CVE202694127", "creation_timestamp": "2026-09-23T10:15:22.820016Z"}]}