AL26-022 - Vulnerability impacting F5 BIG-IP Access Policy Manager (APM) – CVE-2026-94127
What it means
La Canadian Centre for Cyber Security ha identificato una vulnerabilità critica (CVE-2026-94127) in F5 BIG-IP Access Policy Manager (APM) che consente a un attaccante non autenticato di eseguire codice arbitrario. La vulnerabilità è attualmente sfruttata in rete. Le aziende devono aggiornare i sistemi interessati ai hotfix specifici per mitigare il rischio.
Why it matters
Per le PMI italiane, questa vulnerabilità potrebbe portare a compromissioni complete di sistemi critici, esponendo dati sensibili e interrompendo operazioni. L'aggiornamento tempestivo è essenziale per evitare danni economici e reputazionali.
Recommended actions
- Applicare immediatamente i hotfix forniti da F5 per le versioni interessate
- Identificare i sistemi BIG-IP con APM e OAuth configurati su un server virtuale
- Applicare l'iRule fornito da F5 per mitigare la vulnerabilità
- Ricercare indicatori di compromissione (IoC) negli accessi OAuth
- Limitare le interfacce di gestione a reti amministrative fidate
- Seguire le linee guida di F5 per la validazione post-patch
- Implementare le Top 10 IT Security Actions del Cyber Centre
Potential operational benefits
- Riduzione della superficie esposta a attacchi remoti
- Miglioramento della visibilità e del controllo sulle attività di accesso
- Minimizzazione del rischio di compromissione completa del sistema
- Aumento della conformità alle normative di sicurezza
Translation in progress
The official content is available in the original language. The Italian version will be published once automated checks are complete.
Text acquired from the source
Number: AL26-022 Date: September 22, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Canadian Centre for Cyber Security (Cyber Centre) is aware of a critical vulnerability affecting F5 BIG IP Access Policy Manager (APM) Footnote 1 . In response to the vendor advisory released on September 22, 2026, the Cyber Centre released AV26-949 on September 22, 2026 Footnote 2 . Tracked as CVE-2026-94127 Footnote 3 , this vulnerability is a Heap-based Buffer Overflow (CWE-122) Footnote 4 and it affects F5 BIG-IP systems where an APM access policy and an OAuth profile are configured on the same virtual server. Under these conditions, specially crafted malicious traffic may allow an unauthenticated attacker to execute arbitrary code on the affected device, potentially resulting in remote code execution and full system compromise. F5 has indicated that CVE-2026-94127 is being exploited in the wild. Suggested actions The Cyber Centre strongly recommends that organizations running affected F5 BIG‑IP APM deployments upgrade to the following vendor-supported fixed hotfix releases: Affected product Affected versions Fixed Versions BIG IP APM Versions 17.1.0 prior to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG Version 17.1.0 Hotfix-BIGIP-17.1.3.5.0.41.14-ENG BIG IP APM Versions 17.5.0 prior to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG Version 17.5.0 Hotfix-BIGIP-17.5.1.9.0.160.12-ENG BIG IP APM Versions 21.1.0
- Source
- Canadian Centre for Cyber Security (Canada)
- Publishing entity
- Canadian Centre for Cyber Security
- Entity type
- National CSIRT
- Area
- North America · CA
- Original language
- en · translation in preparation
- Publication
- 22/09/2026 21:10
- MITRE ATT&CK
- T1190, T1059, T1562
- CVE
- CVE-2026-94127
- Classification
- Critical
- Stated country
- CA
Affected products and versions
The collector will check NVD and the available official vendor advisories.