> TritonInfoSec News
Home / Sep 24, 2026 / Story
0
#1 The Hacker News general September 23, 2026 at 08:29 UTC

F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

By [email protected] (The Hacker News)

AI Summary

F5 disclosed and patched CVE-2026-94127, a critical zero-day in BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution on systems where APM is configured as an OAuth authorization server. Active exploitation was confirmed prior to the September 22 disclosure, with engineering hotfixes now available. Security teams running BIG-IP APM in OAuth server mode should treat this as an emergency patch given the pre-auth RCE impact.

Read full article → https://thehackernews.com/2026/09/f5-patches-criti…

Relevance score: 92.0/100

# More from September 24

  1. 2
    ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants The Hacker News
  2. 3
    Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks The Hacker News
  3. 4
    Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware The Hacker News
  4. 5
    Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises The Hacker News
  5. 6
    MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key The Hacker News
  6. 7
    Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape The Hacker News
  7. 8
    Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers BleepingComputer
  8. 9
    Check Point warns of hackers exploiting Security Gateway VPN RCE flaw BleepingComputer
  9. 10
    Arista patches actively exploited VeloCloud Orchestrator zero-day BleepingComputer