F5 BIG-IP APM Zero-Day Exploited in RCE Attacks

| 2026-09-23 18:12 CRITICAL HIGH

JSON

Executive Summary AI-generated

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog, a critical advisory that warns of a zero-day vulnerability in F5 BIG-IP APM. The vulnerability affects BIG-IP APM deployments using an access policy together with an OAuth profile on a virtual server. General document context reveals the vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server, and recommends deploying an iRule provided through support channels to affected systems.

Technical Mitigations AI-generated

* Implement OAuth Authorization Server profiles on virtual servers: This configuration will prevent attackers from exploiting the vulnerability when BIG-IP APM operates as an OAuth Authorization Server. * Use iRules to detect and mitigate exploitation attempts: F5 recommends deploying a specific iRule provided through its support channels to the affected BIG-IP APM virtual server, which can help identify and respond to potential exploitation attempts. * Monitor logs for suspicious activity: Regularly review system logs for signs of unauthorized access or code execution, such as TMM SIGABRT events, to detect potential compromises. * Apply hotfixes to vulnerable branches: F5 has released emergency security updates for critical vulnerabilities in BIG-IP APM that attackers are already exploiting. Organizations should apply these hotfixes to affected branches to prevent further exploitation. * Consider a temporary mitigation using an iRule: In the absence of immediate availability of the hotfix, organizations may need to use a temporary mitigation such as deploying an iRule provided through F5's support channels to protect against potential exploitation attempts.

Technical Observables

ips


                                            
                                                17.5.1.3


                                            
                                                17.1.3.5


                                            
                                                21.1.0.2


                                            
                                                17.5.1.9

Intelligence Metadata

Actors / Malware / CVEs / Campaigns

CVE-2025-53521 CVE-2026-94127

Target & Sectors

NORTH_AMERICA

Incident Timeline

‎November 2021

Ransomware exploited a recently patched F5 BIG-IP APM Zero-Day vulnerability.

Click on any entity below to view its context and source!

tactic Ransomware

Since November 2021, CISA has flagged eight actively exploited F5 vulnerabilities , four of which have also been abused in ransomware attacks.

BleepingComputer

‎August 2025

Threat actors exploited a BIG-IP APM Zero-Day vulnerability to gain unauthorized access.

‎October 2025

Threat actors exploited a BIG-IP APM Zero-Day vulnerability to gain unauthorized access.

‎September 22

Threat actors exploited a BIG-IP APM Zero-Day vulnerability to target F5 systems.

Click on any entity below to view its context and source!

attribution Known Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on September 22.

Suggestions