F5 patches exploited BIG-IP APM flaw as U.S. agencies face Friday deadline

Image: Primary

Published Wednesday, September 23, 2026 · 5:08 AM EDT

F5 has released security updates for a critical BIG-IP APM flaw that it says attackers have exploited to run code remotely. BIG-IP APM manages access to organizational networks and applications. The vulnerability affects configurations that use an APM access policy and an OAuth profile on a virtual server; deployments used strictly as OAuth clients or resource servers without authorization server profiles are unaffected. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its list of known exploited vulnerabilities on Tuesday and ordered federal agencies to secure their networks by Friday. F5 also provided a mitigation through its support service for administrators who cannot immediately install the updates.

Sources

BleepingComputer

Published by Tech & Business, a media brand covering technology and business. This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Security Infrastructure

Pwn.ai demonstrates Firecracker guest escape on a host running it as root

Pwn.ai says it escaped a Firecracker microVM and executed a chosen operation as root on the host while the virtual machine remained accessible over SSH.

Security Infrastructure

QNAP warns of suspected NAS compromises through Plex flaws

QNAP says it has received multiple reports of suspected compromises of customers' network storage devices through the Plex2Shell vulnerability chain. The company urges users to update Plex Media Server through its App Center to version 1.43.3.10861.

Security Infrastructure

Some WordPress sites remain exposed while installing security fix

Some WordPress sites remain vulnerable to server code execution while installing the fix for actively exploited CVE-2026-119977, researcher Umut Bayram warned.

Security

Chainalysis says breach exposed password hashes and live tokens for all users

Chainalysis said hackers obtained names, usernames, password hashes and live tokens for all its users following a breach of its network security.

Security

Gnosis Pay discloses customer data breach and adds payment checks

Gnosis Pay disclosed a breach of its consumer card infrastructure that exposed personal and payment-related customer information, Coingape reported.

Security

Veeam distributes fixes for critical Linux kernel vulnerability

Veeam said on Friday that some of its products are affected by CVE-2026-98432, a critical Linux kernel vulnerability, BleepingComputer reported. The flaw allows remote unauthenticated attackers to execute commands as root on servers running Multipath TCP listeners.