F5 BIG-IP Zero-Day CVE-2026-94127: The OAuth Config That Lets Attackers Root Your Edge Appliance
An unauthenticated remote-code-execution bug in F5’s BIG-IP Access Policy Manager is being exploited in the wild right now, and the trigger is a configuration most security teams never treated as an attack surface: OAuth. F5 published an advisory this week for CVE-2026-94127, a critical flaw scoring 9.8 on the CVSS scale. The company confirmed that…