{"vulnerability": "CVE-2026-94127", "sightings": [{"uuid": "b081eb86-eed1-4d77-ae79-9ee822670195", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117315296004023098", "content": "We have just added an important vulnerability affecting F5 BIG-IP (CVE-2026-94127) https://vuldb.com/vuln/408460", "creation_timestamp": "2026-09-22T15:02:36.064494Z"}, {"uuid": "bdb67c2c-f0f0-4143-94da-d218ca2277b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117315299719177302", "content": "EITW 0day in F5 APM. \nhttps://my.f5.com/manage/s/article/K000162605\n\nWhen a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). (CVE-2026-94127)", "creation_timestamp": "2026-09-22T15:03:33.129967Z"}, {"uuid": "4084953d-c5cf-47f1-8ebc-f57214c40d27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw4jnh4myv2t", "content": "CVE-2026-94127 - big-ip\nWhen an access policy and an OAuth profile are set up on a BIG-IP APM virtual server, a specially crafted request can cause the system to execute attacker-controlled code. This can be done\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bigip #f5 #CVE #infosec", "creation_timestamp": "2026-09-22T15:20:07.576886Z"}, {"uuid": "fcd0f8e6-9262-41c4-8f2e-8a32c8d6751a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw4md75pfc2f", "content": "\ud83d\udea8 CVE-2026-94127 \u2014 CVSS 9.3 CRITICAL\n\nWhen a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-94127\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-22T16:08:04.896994Z"}, {"uuid": "2e074ab2-2058-4579-beed-ebb4118feb5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mw4mnrgsus2x", "content": "BIG-IP APM vulnerability CVE-2026-94127\n\n#critical #9.8\n\nmy.f5.com/manage/s/art...", "creation_timestamp": "2026-09-22T16:14:05.761440Z"}, {"uuid": "47440301-cc9b-48a5-881d-f2f1550e2de2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.acn.gov.it/portale/w/f5-big-ip-rilevato-sfruttamento-in-rete-della-cve-2026-94127", "content": "", "creation_timestamp": "2026-09-22T16:15:42.643792Z"}, {"uuid": "a9792aeb-67c8-42de-959d-b74f85d867d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/f5-security-advisory-av26-949", "content": "", "creation_timestamp": "2026-09-22T16:15:45.770106Z"}, {"uuid": "b8aa5b98-dd3d-4051-b70a-68ce0f2f85c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mw4nfzq6r42o", "content": "An exploited BIG-IP APM vulnerability tracked as CVE-2026-94127 allows RCE attacks. Secure your BIG-IP APM vulnerability deployments with new F5 hotfixes.\n\n#F5 #BIGIP #CVE202694127 #Cybersecurity #InfoSec #RCE #Vulnerability", "creation_timestamp": "2026-09-22T16:27:34.721824Z"}, {"uuid": "fb785347-9732-4b5d-a46a-50f6106f38d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-28", "content": "", "creation_timestamp": "2026-09-22T16:45:29.188076Z"}, {"uuid": "22381306-b552-41a8-9048-1d646f7a562c", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f7dd33c2-03c3-4ff2-9f9f-66474c7f9169", "content": "", "creation_timestamp": "2026-09-22T20:00:03.436422Z"}, {"uuid": "8d4a02f5-c742-49aa-8fbf-61da1ef13676", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://gist.github.com/ichintu/36aaaecfd03b65cd834e3e2ec1b2ba36", "content": "This daily cyber threat intelligence digest highlights critical vulnerabilities, active exploits, and emerging security guidance. Key advisories include default credential exposure in HPE ALE (CVE-2026-76708, CVSS 9.8), an actively exploited heap overflow in F5 BIG-IP APM (CVE-2026-94127), and a DoS flaw in Vector/Logstash (CVE-2026-77620). Additional affected platforms include Erlang OTP and MikroTik RouterOS, with patches and hotfixes available. On the threat actor front, a malicious npm package disguised as a Twilio tool is harvesting credentials, while a new zero-day PoC (BigDiskBuster) disrupts Microsoft Defender updates by exhausting disk space. The digest also features technical analysis of MikroTik disclosures, an open-source architecture for offline clinic ID verification, and a practical guide on avoiding false-positive RCE reports by validating delays with control requests and computed outputs rather than relying on time-based checks. Organizations are urged to apply vendor updates, monitor for credential exfiltration, and strengthen vulnerability validation practices.", "creation_timestamp": "2026-09-22T20:01:40.607492Z"}, {"uuid": "95992178-9b02-4f06-a734-822b62bb9479", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mw4zjbl7p42w", "content": "\ud83d\uded1 CVE-2026-94127\nF5 BIG-IP APM\nCVSS 9.3 / KEV: No\nTL;DR: When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malici\u2026\nhttps://cvesentinel.com/report/CVE-2026-94127?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-22T20:04:07.348978Z"}, {"uuid": "bebe691d-a271-4595-a024-ef157e182b09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-022-vulnerability-impacting-f5-big-ip-access-policy-manager-apm-cve-2026-94127", "content": "", "creation_timestamp": "2026-09-22T20:15:06.583173Z"}, {"uuid": "711a37ca-cb19-4659-887c-bb62d98f2416", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mw52zat6a522", "content": "CVE-2026-94127 now in CISA KEV.\nActively exploited F5 BIG-IP APM zero-day.\n\u2022 Heap-based buffer overflow\n\u2022 CVSS v4 9.3\n\nhttps://thecircuitry.to/article/cisa-adds-actively-exploited-f5-big-ip-apm-flaw-to-kev-catalog-mud3ryl7", "creation_timestamp": "2026-09-22T20:30:57.797508Z"}, {"uuid": "e48c809d-fcef-4daa-b73c-5ecdefce2728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94127", "type": "seen", "source": "https://infosec.exchange/ap/users/115741367687413652/statuses/117316666030287896", "content": "When it rains, it pours. F5 BIG-IP APM also has an exploited CVE!\nhttps://ifin.network/t/f5-big-ip-cve-2026-94127-rce-exploited/855\n#ThreatIntel #ThreatIntelligence #IFIN", "creation_timestamp": "2026-09-22T20:51:56.250402Z"}, {"uuid": "9dabcb2e-bccf-4b4f-acca-641c4616d388", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mw55z2eriz2v", "content": "K000162605: BIG-IP APM vulnerability CVE-2026-94127", "creation_timestamp": "2026-09-22T21:24:31.669335Z"}, {"uuid": "6ad342bf-e405-452e-a9d0-42c962aac599", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mw5ddlqbs32c", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-94127", "creation_timestamp": "2026-09-22T22:59:54.507060Z"}, {"uuid": "0203d3b3-e404-4dbb-9d74-5b86cf61c98f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.acn.gov.it/portale/w/f5-big-ip-rilevato-sfruttamento-in-rete-della-cve-2026-94127", "content": "Rilevato lo sfruttamento in rete di una vulnerabilit\u00e0, identificata tramite la CVE-2026-94127, presente in BIG-IP APM. Tale vulnerabilit\u00e0, qualora sfruttata, potrebbe consentire a utenti malintenzionati remoti di eseguire codice arbitrario sui sistemi interessati.", "creation_timestamp": "2026-09-23T01:00:44.451949Z"}, {"uuid": "06987729-8c70-457c-872f-cfe749649d3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mw5uc2gdc22c", "content": "~Certeu~\nActively exploited unauthenticated RCE affects BIG-IP APM; patch urgently.\n-\nIOCs: CVE-2026-94127\n-\n#CVE202694127 #F5 #ThreatIntel", "creation_timestamp": "2026-09-23T04:03:16.780522Z"}, {"uuid": "e28cf65a-a056-4beb-9b4c-07d1152d50d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/f5-big-ip-remote-code-execution-vulnerability_20260923", "content": "", "creation_timestamp": "2026-09-23T04:48:28.572197Z"}, {"uuid": "6ef3a239-d040-4ab4-9545-a30b603794ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mw5xliytoj2d", "content": "Daily IT Security Digest \u2014 2026-09-23\nconcerning because attackers now possess proprietary code that could reveal previously unknown vulnerabilities (0-days) in widely deployed F5 appliances. CVE-2026-94127 (RCE) and CVE-2026-93616 (Check Point RCE) are among the newly exposed concerns.", "creation_timestamp": "2026-09-23T05:02:14.474200Z"}, {"uuid": "4662e55a-82f2-4849-a54f-b5c7f9f20f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mw64jmd4zl2x", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-94127: \u26a0\ufe0f CVE-2026-94127: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-94127-when-a-big-ip-apm-access-policy", "creation_timestamp": "2026-09-23T06:30:39.853250Z"}, {"uuid": "865c5200-c8de-418f-97b0-193d336080ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94127", "type": "seen", "source": "https://t.me/infosec_ita_notizie/4103", "content": "\u2615 CYBERBRIEFING \u2014 Mercoled\u00ec 23 settembre 2026\n\n\u2615 CYBERBRIEFING \u2014 Mercoled\u00ec 23 settembre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \ud83d\udd34 IN PRIMO PIANO Zero-day critico su F5 BIG-IP APM: attacchi gi\u00e0 in corso, controllo remoto senza autenticazione \u00c8 stata scoperta una vulnerabilit\u00e0 zero-day (CVE-2026-94127) nel modulo\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-09-23\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "creation_timestamp": "2026-09-23T07:00:04.913530Z"}]}