F5 BIG-IP Remote Code Execution Vulnerability

CVE-2026-94127

September 23, 2026 · HKCERT · Severity: HIGH

This article describes a remote code execution vulnerability in F5 BIG-IP APM, CVE-2026-94127, which is being actively exploited. The affected versions are listed, and F5 has provided workarounds to mitigate the risk until a permanent fix is available. 📌 **Analyst Note:** Active exploitation of this vulnerability means attackers are already targeting unpatched F5 BIG-IP appliances. Security teams should apply the vendor's workarounds immediately and monitor for any signs of compromise, as these devices often handle sensitive authentication traffic.

Key Takeaways

A remote code execution vulnerability in F5 BIG-IP, tracked as CVE-2026-94127, is being actively exploited in the wild and affects BIG-IP APM versions 17.1.0 through 17.1.3, 17.5.0 through 17.5.1, and 21.1.0.
The vulnerability allows a remote attacker to execute arbitrary code on the targeted system, posing a critical risk to organizations using F5 BIG-IP for application delivery and access management.
F5 has issued workarounds for this vulnerability, and administrators should apply the recommended mitigations immediately to protect their networks from ongoing exploitation.