Someone's attacking a critical 0-day RCE in F5 BIG-IP APM

F5 has patched a critical remote code execution vulnerability in its BIG-IP Access Policy Manager platform. Tracked as CVE-2026-94127, the heap-based buffer overflow flaw carries a CVSS score of 9.8. It specifically impacts deployments configured as OAuth authorization servers. Both CISA and F5 warn that the vulnerability was under active exploitation in the wild before the fix. BIG-IP APM is used by companies to manage internal network resource access, authentication, and VPN connectivity for remote users.