Most recent entries from all

certfr-2026-avi-1220 — Une vulnérabilité a été découverte dans F5 BIG-IP. Elle permet à un attaquant de provoquer une exécution de code arbitr…

2026-09-29T13:06:36.200940+00:00

certfr-2026-avi-1220

fkie_cve-2026-94127

2026-09-29T13:06:36.201042+00:00

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.

Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

GHSA-qppv-6jrg-hxq4

2026-09-29T13:06:36.201128+00:00

When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NCSC-2026-0386 — Kwetsbaarheid verholpen in F5 Networks BIG-IP Access Policy Manager

2026-09-29T13:06:36.201166+00:00

NCSC-2026-0386