F5 has released engineering hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in BIG-IP Access Policy Manager (APM) that is being actively exploited. The flaw allows unauthenticated remote code execution on BIG-IP systems where APM functions as an OAuth authorization server. This vulnerability poses a severe risk, enabling attackers to gain full control over affected systems without prior authentication.