F5 security advisory (AV26-949) - Update 1

Serial number: AV26-949Date: September 22, 2026 As of September 22, 2026, F5 is affected by a vulnerability in the following product: BIG-IP APM Versions 21.1.0 prior to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG Versions 17.5.0 prior to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG Versions 17.1.0 prior to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG F5 has reported that CVE-2026-94127 is being exploited in the wild. Update 1 On September 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-94127 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. K000162605: BIG-IP APM vulnerability CVE-2026-94127 2026 security notifications CISA KEV: CVE-2026-94127