Loading story…
F5 BIG-IP Access Policy Manager (APM) contains an actively exploited critical buffer-overflow vulnerability, CVE-2026-94127 (CVSS 9.8), that enables unauthenticated remote code execution. An attacker can send specially crafted traffic to a vulnerable virtual server configured with both an APM access policy and an OAuth profile; the flaw affects the data plane, including Appliance Mode deployments, but not the control plane.
Affected releases include BIG-IP APM 21.1.0, 17.5.x, and 17.1.x versions lacking the applicable engineering hotfixes. F5 and national cyber agencies urge administrators to install the vendor hotfixes immediately; an F5 iRule is available as a temporary mitigation. Defenders should investigate repeated OAuth failures, suspicious commands, and TMM SIGABRT crashes using F5’s compromise guidance, while treating any single indicator as insufficient evidence of compromise.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-949 concerning actively exploited CVE-2026-94127 and advised administrators to review F5 guidance and apply required updates.
F5 reported that CVE-2026-94127 was being exploited in the wild. The flaw can allow unauthenticated remote code execution against vulnerable BIG-IP APM virtual servers configured with both an access policy and an OAuth profile.
F5 received the CVE record for CVE-2026-94127, a critical buffer-overflow flaw in BIG-IP Access Policy Manager's OAuth component.
F5 published advisory K000162605 with engineering hotfixes for affected BIG-IP APM 21.1.0, 17.5.x, and 17.1.x releases, plus an iRule mitigation for cases where patching cannot immediately occur. It also provided indicators for investigating potential compromise, including repeated OAuth failures, suspicious commands, and TMM SIGABRT events.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourceacn.gov.it
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **`CVE-2025-53521`** to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a flaw in **F5 BIG-IP Access Policy Manager (APM)**. The vulnerability affects BIG-IP **17.x, 16.x, and 15.x** when an APM access policy is configured on a virtual server, and specially crafted unauthenticated traffic can crash and restart the **TMM** process, creating a path to potential **root-level remote code execution**. F5 had initially treated the issue as a denial-of-service bug, but reclassified it as **RCE** after new information emerged, sharply raising the severity of the threat. F5 said fixes were released in February 2025, with patched versions including **17.1.0.4**, **16.1.4.3**, and **15.1.10.2** or later, and warned that end-of-technical-support systems should be considered unprotected. CISA ordered Federal Civilian Executive Branch agencies covered by **BOD 22-01** to remediate by **March 30, 2026**, while urging organizations to assess internet-exposed F5 devices, review F5-published indicators of compromise and attacker tradecraft, and investigate for signs of intrusion. Reporting also noted the KEV listing comes after F5's earlier nation-state compromise, which allegedly exposed source code and undisclosed vulnerability information.
Jun 29, 2026
F5 disclosed a critical flaw in the **BIG-IP iControl REST** interface, tracked as **`CVE-2022-1388`**, that allows attackers to bypass authentication and achieve unauthenticated remote code execution on exposed administrative interfaces. The issue affects the interaction between Apache and the iControl REST service, where crafted requests abusing headers such as **`X-F5-Auth-Token`** and **`Connection`** can reach privileged command-execution functionality without valid credentials. The vulnerability carries a **CVSS 9.8** rating and impacts multiple BIG-IP versions, prompting F5 to publish patches and mitigation guidance. Technical analysis showed the bug stems from request-handling logic that lets specially formed traffic evade normal authentication checks and invoke sensitive endpoints. Security reporting also indicated the flaw was being **actively exploited in the wild**, with thousands of potentially vulnerable internet-exposed BIG-IP systems observed, increasing the risk to organizations using the platform for application delivery and security services. Defenders were urged to patch affected devices quickly or apply F5’s recommended mitigations to restrict exposure of the management interface.
Aug 6, 2026
China-attributed **APT5** actively exploited `CVE-2022-27518`, a critical Citrix ADC and Citrix Gateway flaw that lets an unauthenticated remote attacker execute arbitrary code and bypass authentication controls. The activity prompted a joint U.S. government cybersecurity advisory detailing threat-hunting guidance and indicators associated with exploitation. The vulnerability affects customer-managed Citrix appliances configured as a SAML service provider or SAML identity provider; Citrix ADC and Citrix Gateway 13.1 are not affected. Organizations should urgently apply Citrix’s security updates, disable SAML authentication where operationally feasible until remediation is complete, and hunt for the published indicators of compromise.
Sep 3, 2026