CVE-2026-94127

Exploited BIG-IP APM Vulnerability Allows Remote Code Execution Diagram detailing the exploited BIG-IP APM vulnerability and CVE-2026-94127 flow

Do Son September 22, 2026

TL;DR On September 22, 2026, F5 disclosed a critical flaw in its Access Policy Manager software. This...

📧

Email Delivery
Get threat intel straight to your inbox.

♾️

Unlimited Vendors
Track every technology in your stack.

🚨

All New CVE Alerts
Be the first to know about new flaws.

⚙️

Custom EPSS Threshold
Filter noise, focus on real risks.

💬

Slack & Teams Webhook
Integrate directly into your SecOps.

🚫

100% Ad-Free
Enjoy an uninterrupted reading experience.

$7/mo

CVE-2026-94127CVSS 9.8
When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious...
Admin intel📅 Updated: Sep 22, 2026
CVE-2026-85102CVSS 9.8
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote...
Admin intel📅 Updated: Sep 22, 2026
CVE-2026-93616CVSS 9.8
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on...
Admin intel📅 Updated: Sep 22, 2026
CVE-2026-93952CVSS 10.0
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access...
Admin intel📅 Updated: Sep 22, 2026
CVE-2026-32996CVSS 7.3
A vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
Admin intel📅 Updated: Sep 22, 2026
CVE-2026-7273CVSS 8.8
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a...
CISA KEV📅 Added to KEV: Sep 21, 2026
CVE-2026-58138CVSS 9.8
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute...
Admin intel📅 Updated: Sep 20, 2026
CVE-2026-86124CVSS 9.8
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and...
Admin intel📅 Updated: Sep 19, 2026

CVE-2026-73749CVSS 9.8
Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An...
📅 Updated: Sep 22, 2026
CVE-2026-87121CVSS 9.8
lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution...
📅 Updated: Sep 22, 2026
CVE-2026-93012CVSS 9.8
Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address...
📅 Updated: Sep 22, 2026
CVE-2026-79313CVSS 9.8
webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to...
📅 Updated: Sep 22, 2026
CVE-2026-75697CVSS 9.3
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker...
📅 Updated: Sep 22, 2026
CVE-2026-76708CVSS 9.8
A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use...
📅 Updated: Sep 22, 2026
CVE-2026-76709CVSS 9.8
A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this...
📅 Updated: Sep 22, 2026
CVE-2026-75686CVSS 9.3
Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in...
📅 Updated: Sep 22, 2026