Critical F5 BIG-IP Vulnerability Exploited as Zero-Day

https://www.securityweek.com/wp-content/uploads/2023/10/F5-Vulnerability.jpg

F5 and CISA on Tuesday warned organizations that threat actors have been exploiting a critical-severity BIG-IP Access Policy Manager (APM) vulnerability as a zero-day.

The flaw is exploitable via malicious traffic sent to the appliance when “a BIG-IP APM access policy and an OAuth profile are configured on a virtual server,” F5 notes in its advisory.

Tracked as CVE-2026-94127 (CVSS score of 9.8), the bug allows unauthenticated attackers to achieve remote code execution (RCE) on a vulnerable deployment.

“We have learned that this vulnerability has been exploited,” F5 says, noting that it discovered the security defect internally.

According to the company, the issue can be triggered only when BIG-IP APM is configured as an OAuth Authorization Server, not on deployments using APM as an OAuth Client/Resource Server.

“The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure,” the...

Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE

Read more

http://www.techmeme.com/img/techmeme_sq328.png

Apple says HomeView's facial recognition works only if users have a “registered personal device” with Apple Intelligence and Siri AI on the same Wi-Fi network

Featured Podcasts Training Data: David Silver and Lasse Espeholt of Ineffable Intelligence: A Superlearner for the Age of Experience Sequoia Capital partners host conversations with leading AI builders and researchers to develop a deeper understanding of the evolving technologies and their implications. Subscribe to Training Data. Invest Like the Best: