A major flaw in F5 BIG-IP Access Policy Manager is under attack right now. Hackers can run code on OAuth authorization servers without logging in. Agencies in Europe, Canada, and the UK are calling for immediate action as F5 rolls out emergency fixes.
Hackers are already taking advantage of a serious bug in F5 BIG-IP Access Policy Manager. They are targeting OAuth authorization servers and getting around authentication to run code from afar. This flaw, tracked as CVE-2026-94127, pushed F5 to rush out emergency hotfixes. Cybersecurity agencies in Europe, Canada, and the UK have all issued urgent warnings.
This is not just a possible threat. F5 confirmed real-world attacks in its September 22, 2026 advisory. The Canadian Centre for Cyber Security says a successful attack could let hackers take over the whole system. The bug is a heap-based buffer overflow. It scores 9.8 on the CVSS v3.1 scale and 9.3 on CVSS v4.0. Only BIG-IP APM setups that act as OAuth authorization servers are at risk.
Who is really exposed and why configuration matters
Not every BIG-IP APM setup is in danger. The flaw only hits appliances where APM is set up as an OAuth authorization server. If APM is just an OAuth client or resource server, it is not affected. This detail matters. Just having BIG-IP APM in your network does not mean you are at risk. Admins need to check each deployment's role and see how access policies and OAuth profiles connect to virtual servers.
F5's own docs make it clear: in a vulnerable setup, client apps sign up with APM to get OAuth tokens and codes. The weak spot is the data plane, not the control plane. Malicious traffic can reach the virtual server that handles app requests, even if the management interface is locked down. Even appliances running in appliance mode are still exposed.
CERT-EU has confirmed that CVE-2026-94127 is a heap-based buffer overflow vulnerability in BIG-IP APM, enabling unauthenticated remote code execution on affected devices. The flaw is actively exploited and impacts versions 17.1.x, 17.5.x, and 21.1.x when configured as an OAuth Authorization Server.
Hotfixes available and the rush to check systems
F5 has put out engineering hotfixes for three BIG-IP release lines. For 17.1.x, the fix is Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. For 17.5.x, it is Hotfix-BIGIP-17.5.1.9.0.160.12-ENG. For 21.1.0, it is Hotfix-BIGIP-21.1.0.2.0.30.22-ENG. Admins must check the exact build running. Just seeing "17.5.1" is not enough to know you are safe. Software that is past its End of Technical Support date has not been checked and should not be trusted as secure.
Locking down the management interface does not fix this problem. The bug is hit through the application data path. So even if the management network is isolated, you are still at risk if the virtual server faces the internet. CERT-EU tells organizations to save forensic evidence before patching. Just applying the hotfix does not mean the system was not already breached.
Operational impact and limits of public information
There is little public detail about the attacks. Security firm mnemonic says exploitation is confirmed, but no one knows how widespread it is or what happens after the breach. No public proof of concept has appeared, but attackers have already shown they can exploit the bug. The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-94127 to its Known Exploited Vulnerabilities list, showing how urgent the situation is. Italy's Agenzia per la Cybersicurezza Nazionale (ACN) has repeated the call for fast fixes, matching CISA's September 25, 2026 deadline for federal agencies. More technical details are in the CERT-EU advisory.
The way the affected service works makes incident response harder. F5's OAuth authorization server endpoints handle giving out, revoking, and checking tokens. If the system is breached, trust between the appliance and connected apps could be broken. This means the investigation may need to go beyond the device itself. So far, there is no sign in public advisories that attackers have stolen signing keys or made fake tokens, but the risk is still there.
Lessons from the response and recent history
Sophos recently studied an earlier BIG-IP APM bug (CVE-2025-53521) and found malware that put a PHP web shell in memory, leaving no trace on disk. There is no direct link to CVE-2026-94127, but this shows why just looking for suspicious files is not enough when checking for a breach.
Security teams now have to find out which setups are at risk, make sure the right hotfix is installed, and save evidence as F5 and incident response teams advise. If a breach is suspected, recovery must look at how the appliance connects to identity services and other apps. The risk is real. NHS England's National Cyber Security Operations Centre says more attacks are very likely, especially for edge appliances that face the internet.
Groups that have dealt with similar zero-day attacks-like those in this earlier report-know that the line between a narrowly defined risk and a wide-scale exposure can be razor-thin. The takeaway: technical details in how you set up your system can mean the difference between staying safe and facing disaster.
F5's emergency patch shows a hard truth in modern IT. Even a specialized setup can become a major business risk if it handles sensitive authorization. The only smart move is to act fast, check if you are exposed, apply the right hotfix, and treat the hunt for past breaches as a separate, urgent job. Anything less leaves the door open for attackers who have already shown they are quick to strike.
