F5 BIG-IP APM: Schwachstelle ermöglicht Codeausführung
WID-SEC-2026-3517 · first 23.09.2026 · updated 23.09.2026 · CVSS 9,8
What it is about
BIG-IP ist eine Netzwerk Appliance auf der die meisten F5 Produkte laufen. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in F5 BIG-IP APM ausnutzen, um beliebigen Programmcode auszuführen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- beliebigen Programmcode auszuführen
Am I affected?
Affected according to the BSI:
- F5 BIG-IP APM 21.1.0 <Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso
- F5 BIG-IP APM 17.x <Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso
- F5 BIG-IP APM 17.x <Hotfix-BIGIP 17.1.3.5.0.41.14-ENG.iso
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- F5 BIG-IP APM 21.1.0 Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso
- F5 BIG-IP APM 17.x Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso
- F5 BIG-IP APM 17.x Hotfix-BIGIP 17.1.3.5.0.41.14-ENG.iso
Is the vulnerability already being exploited?
- CVE-2026-94127: exploited in the wild according to CISA, in the catalogue since 22.09.2026.
Information and sources
- Original BSI advisory (WID)
- F5 Security Advisory vom 2026-09-22 my.f5.com
- GitHub Security Advisory GHSA-qppv-6jrg-hxq4 vom 2026-09-22 github.com
CVE: CVE-2026-94127
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.