F5 has released hotfixes for a critical BIG-IP Access Policy Manager flaw, tracked as CVE-2026-94127, after warning that the vulnerability has been exploited. The issue affects certain BIG-IP APM deployments when an access policy and an OAuth authorization server profile are configured on a virtual server.
That detail matters because many businesses do not think of remote-access appliances as everyday business systems. They sit at the edge of the network, support access to applications, and often belong to a gray area between the MSP, a firewall vendor, a hosting provider, and the internal IT team. When one of those systems has an exploited remote code execution flaw, the owner question is not simply, Did someone patch it? It is, Do we know whether we have it, whether it is exposed, and whether anyone checked for signs of compromise?
The business risk is visibility, not just vulnerability
BleepingComputer reported on September 23, 2026 that F5 released updates for the flaw. SecurityWeek also reported that F5 and CISA warned organizations about active exploitation, and that CISA added the CVE to its Known Exploited Vulnerabilities catalog. The CIRCL mirror of the CISA KEV entry lists a September 25, 2026 due date and describes the required action as applying vendor mitigations and following risk-based remediation guidance.
For a New Jersey business owner, the technical trigger is less important than the operating reality. If a company uses BIG-IP APM, the business needs someone accountable for confirming whether the vulnerable OAuth authorization server configuration exists. If it does, the next decision is whether the hotfix, mitigation, and follow-up review have been completed. Remote access is useful because it opens doors for legitimate work. The uncomfortable part is making sure the keys are not hanging in the hallway.
What owners should ask their IT provider
This is a good moment to ask for plain-language evidence instead of a vague assurance. A useful response should answer the specific asset question, not only the general patch question.
- Do we use F5 BIG-IP APM anywhere in our environment, including hosted, managed, or inherited systems?
- Is any BIG-IP APM deployment configured as an OAuth authorization server with an access policy and OAuth profile on a virtual server?
- Was CVE-2026-94127 addressed with the vendor hotfix or documented mitigation?
- Were F5's indicators of compromise reviewed, and what time period did the review cover?
- Who owns the proof: the MSP, firewall vendor, hosting provider, internal IT team, or another party?
- Are edge appliances included in the regular asset list, renewal review, and patch evidence process?
A practical next step
Owners do not need to become F5 engineers to manage this risk. They need a clear inventory and an accountable answer. Ask your provider for a short written note that states whether BIG-IP APM is present, whether the vulnerable configuration applies, what action was taken, and whether any suspicious signs were reviewed.
If the answer is we are not sure, treat that as a process gap rather than a personal failure. Edge systems, remote-access tools, and application delivery appliances often outlive the people who originally installed them. The responsible move is to bring them back into the asset list, assign ownership, and require patch evidence before the next urgent advisory arrives.
Sources and further reading
