sign in--:--:--UTC

CVE-2026-94127

exploited in the wild☆ pin

CVSS

9.8

Reports

11

First seen

Sep 22, 2026

Last seen

Oct 13, 2026

Affected product

F5 BIG-IP APM (versions 17.1.0–17.1.3, 17.5.0–17.5.1, 21.1.0)

Associated actors

ShinyHunters ×2 Red Heron ×1 Storm-2570 ×1 Storm-3168 ×1 Suspected Chinese-speaking threat actor ×1 Suspected Russian-speaking threat actor ×1 TeamFiltration ×1 UAT-11823 ×1 UAT-11988 ×1 UAT-12197 ×1 NightEagle ×1 UNC3569 ×1

Recent reports

September 2026 CVE Landscape: 94 High-Impact Vulnerabilities with Active Exploitation

Recorded Future InsiktOct 13, 2026 Critical

Critical FortiMail Zero-Day Exploited in Attacks Enables Unauthenticated File Writes

The Hacker NewsOct 2, 2026 High

Check Point Threat Intelligence Report – 28 September

Check Point ResearchSep 28, 2026 Critical

F5 BIG-IP APM Zero-Day RCE in OAuth Servers Actively Exploited

The Hacker NewsSep 23, 2026 Critical

F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks

Bleeping ComputerSep 23, 2026 Critical

F5 BIG-IP APM Remote Code Execution Vulnerability Exploited in the Wild

GovCERT.HKSep 23, 2026 High

F5 BIG-IP Remote Code Execution Vulnerability (CVE-2026-94127)

HKCERTSep 23, 2026 Critical

Critical F5 BIG-IP APM Vulnerability (CVE-2026-94127) Exploited in Wild

Canadian Centre AlertsSep 22, 2026 Critical

Critical Vulnerability in F5 BIG-IP APM (CVE-2026-94127)

CERT-EU AdvisoriesSep 22, 2026 High

F5 BIG-IP CVE-2026-94127 Actively Exploited in the Wild

Canadian Centre AlertsSep 22, 2026 High

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA AdvisoriesSep 22, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans