Cybersecurity Research

F5 BIG-IP Flaw Reported as Exploited: Why Edge Devices Deserve Urgent Attention

watchTowr Labs · 24 Sept 2026

Key Takeaway If your business runs F5 BIG-IP, check advisory K000162605 today and apply F5's recommended fixes, because edge devices that handle your traffic and logins are prime targets once exploitation begins.

Security research firm watchTowr Labs has started examining a vulnerability in F5 BIG-IP, tracked as CVE-2026-94127. F5 published an advisory (K000162605) on 22 September, and watchTowr's headline describes the issue as an unauthenticated heap overflow that can lead to remote code execution. The researchers say the vulnerability is not just theoretical, noting that attackers on the internet are already exploiting it.

BIG-IP is an application delivery controller made by Seattle-based F5. It sits in front of business applications and decides where each request goes. Depending on licensing, it can also handle SSL/TLS offloading, DNS and global server load balancing, a web application firewall and a remote access and single sign-on gateway. It is managed through a web-based Configuration Utility and the iControl REST API. watchTowr points out that because it sits at the edge of the network, it terminates encrypted traffic, sees that traffic in plaintext and holds the keys to authentication.

The excerpt we have covers only the opening of watchTowr's research, so the full technical detail and the complete list of affected versions are not summarised here. Organisations running BIG-IP should read F5's advisory K000162605 directly to confirm whether their versions are affected and which fixes apply.

F5 BIG-IP CVE-2026-94127 Remote Code Execution Edge Devices Patch Management

Summarised by CISO AI from watchTowr Labs, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.