CISA has added CVE-2026-94127, affecting F5 BIG-IP APM, to its catalogue of vulnerabilities being exploited in the wild. Added: 22 September 2026. Deadline to act: 25 September. Three days.
What happened
It is a heap memory corruption bug —the classic CWE-122— that shows up when a virtual server has both an access policy and an OAuth profile attached. Under those conditions an attacker with no credentials can end up running code on the box. The box that terminates your VPNs and your user authentication. The one facing the internet.
The entry in CISA's known-exploited vulnerabilities catalogue carries two details that rarely travel together:
- A two-step fix. First you apply an iRule published by the vendor to plug the hole temporarily; then the final patch as soon as you can. F5's own advisory has the specifics, and the technical record is on NVD.
- Forensic triage required. For US agencies, the risk-based patching directive CISA issued this year (the one numbered BOD 26-04) demands that evidence be gathered before anything is touched in flagged cases. This one is flagged.
On ransomware use, the catalogue says "unknown". That is not a no. It means there is no record.
And one bit of context that only shows up in the full list: this makes eight F5 flaws in the catalogue. The management interface bug from 2020, the missing-authentication one from 2022, the chained pair from 2023 —an authentication bypass plus a SQL injection—, the stack overflow in APM from March this year, and now this. It is a structural repeat offender.
Why it matters
The bug is not the point. The clock is.
In October 2023, that pair of flaws entered the catalogue with three weeks of slack: added on 31 October, due on 21 November. In 2022, the same: twenty-one days. In March 2026, the APM stack overflow was published on a Friday and had to be resolved by Monday. Now, three days again.
Which means the maintenance window is no longer something you negotiate with the client. It is set by the exploitation timeline, because a flaw does not land in that catalogue for being severe: it lands because somebody is already using it on somebody else. If your process for patching an edge device runs through next month's change board, you do not have a process.
What I would change from today, concretely:
- Know what you have exposed, and in what configuration. The condition here is very specific: access policy plus OAuth profile on the same virtual server. Half an hour of inventory saves you a whole night. But that half hour has to be spent beforehand, not on advisory day.
- Have the emergency window written down. Who authorises it, at what hour service drops, who warns the users, how long a rollback takes. Improvise that and the three days disappear into email threads.
- Collect evidence before patching, not after. This is the step most people skip. Patching a compromised box wipes the trail: you end up secure and blind at the same time. Configuration dump, logs, new accounts and keys, scheduled tasks. Then apply the mitigation.
- Do not mistake the iRule for the patch. The temporary mitigation buys you hours. I have seen the emergency workaround become permanent configuration too many times, simply because nobody closed the ticket.
What does not change
Three things, so as not to overstate it.
One: not every BIG-IP APM install is vulnerable. It needs that specific combination of access policy and OAuth. If you do not have it, this one is not about you —and checking is faster than panicking.
Two: CISA's catalogue is binding for US federal bodies. For a company in Valencia it obliges nothing. What makes it useful is something else: it is the best public list of "this is already being exploited", and that makes it a sound prioritisation input even when no directive applies to you.
Three: edge appliances being the way in is hardly a 2026 novelty. The 2020 F5 flaw that ended up in ransomware campaigns told exactly the same story. What has changed is the speed between disclosure and exploitation, not the nature of the problem.
Our take
My view: three-day deadlines are right, and they will get shorter. Anyone calling them unrealistic is confusing the symptom with the disease. The deadline is not unrealistic; what is unrealistic is having the company's access concentrator on the public internet and not knowing who patches it or when it was last patched.
What I think will age badly is the single-appliance model at the perimeter: it terminates TLS, handles authentication, speaks OAuth to your identity provider and ships its own admin panel on top. Every added function is new attack surface, and those eight F5 entries make the argument without any theory needed. The honest minimum: management interface off the internet, always, and a vendor advisory subscription that reaches a named person rather than a generic mailbox.
One pet peeve of mine: advisory day is not the day to improvise evidence collection. A forensic procedure written with the clock running is written badly. Far better to have it as four bullet points in a boring document nobody reads until the day it matters.
This is exactly what we run into when we go in to review someone's perimeter: the patch is almost never missing because it does not exist, it is missing because nobody knew that box was exposed or who was responsible for touching it. The boring inventory is worth more than the expensive tool.
Any questions, tell me and we'll look at it.
Best, Vicente.