F5 Patches Critical BIGIP APM ZeroDay Exploited for Unauthenticated RCE on OAuth Servers

Attackers are exploiting a critical flaw in F5 BIGIP Access Policy Manager APM that lets them run code on a BIGIP system without logging in F5 says The flaw CVE202694127 affects only systems in which APM serves as an OAuth authorization server issuing access tokens to applications F5 disclosed it in an advisory on September 22 and has released engineering hotfixes