decrypted · 23 september 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

F5's access gateway let attackers in without a password

F5 spent Monday telling customers that the box sitting at the edge of their network, the one whose entire job is deciding who gets in, had a hole in it that needed no password to walk through. CVE-2026-94127, a heap-based buffer overflow in BIG-IP's Access Policy Manager, scores 9.8 out of 10 and is already being exploited in the wild. It was one of four vulnerabilities the US Cybersecurity and Infrastructure Security Agency added to its known-exploited list on the same afternoon, alongside two Check Point flaws and one in Arista's VeloCloud orchestrator. BIG-IP sits in front of banks, telecoms providers, insurers and government departments across the UK, doing precisely the job this bug undermines, and it is not the kind of box that gets taken offline lightly to patch.

How the door swung open

The flaw only bites on a virtual server configured with both an APM access policy and an OAuth profile, a common combination for anything doing single sign-on. When a client authenticates, the OAuth handling code copies attacker-influenced data into a fixed-size heap buffer without checking how much of it there is. Send more than the buffer allows and the excess spills into adjacent memory, corrupting the data structures the traffic management microkernel uses to decide what to do next. Control of that memory becomes control of execution, no credentials required. Picture a bouncer's clipboard with no limit on how much a visitor can write on the sign-in sheet: fill it past the edge and the ink starts landing on the guest list itself, and now the guest list says whatever the visitor wrote.

A bad afternoon for edge appliances generally

F5 was not alone that day. Check Point disclosed active exploitation of a path traversal bug in its management server, letting attackers upload and run scripts without logging in, and separately confirmed attempts against its Spark firewalls through a certificate-validation bypass in VPN setup that started days after the patch shipped. Arista's VeloCloud orchestrator made the same CISA list for an input validation flaw. None of these four bugs share a codebase, but they share a category: internet-facing appliances built to be trusted gatekeepers, all patched in the same week because someone was already inside testing them. NCSC guidance issued earlier this year told UK organisations to baseline their VPN and remote-access traffic precisely because edge devices are where covert access gets established quietly. This is what that warning looked like arriving.

The Secure by Design lesson

The design decision that would have stopped CVE-2026-94127 is unglamorous: validate the length of untrusted input before writing it into fixed memory, on code that by definition handles traffic from anyone on the internet before they have proven who they are. F5 is a signatory to pledges on exactly this kind of secure-by-design commitment, which makes a pre-authentication heap overflow in an access-control product a useful embarrassment rather than a surprise. For UK organisations the immediate task is patching or applying F5's emergency iRule wherever APM and OAuth profiles coexist, and checking logs for repeated OAuth failures or unexpected TMM crashes as signs of probing. The longer task is treating what sits at the network edge as a supplier-risk question with a paper trail, not a purchasing decision made once and forgotten.

Also this week

ShinyHunters, the extortion crew that spent last week hijacking Cl0p's leak site, claims a bigger prize this week: unauthorised access to FBI systems via a new pre-authentication Oracle PeopleSoft zero-day, with 2 to 3TB of data allegedly taken from HR, Medlink and criminal-justice systems before the group defaced the FBI's jobs website. The FBI says only that it is investigating unauthorised activity; Oracle has not confirmed the flaw. Treat the breach claim as exactly that, a claim, but the underlying vulnerability is real, Mandiant has separately confirmed exploitation in the wild, and PeopleSoft runs HR and pensions systems across UK universities and public bodies. The group says it is now working through Fortune 500 targets with the same bug, having previously hit the education sector.

Spain's data protection authority disclosed what it called the country's first breach carried out by an autonomous AI agent: pointed at a target application, the agent chained reconnaissance, login, vulnerability discovery and data exfiltration into one continuous run, modifying records and pulling invoices without a human keying in each step. None of those techniques is new; what changed is that machine speed closed the gaps defenders normally rely on to notice and react between stages. The agency's recommendations were blunt: fold AI-assisted attacks into risk assessments, review incident-response timelines built for human-speed threats, and treat vulnerability correction and data minimisation as more urgent, not less, now that discovery-to-exploitation can happen inside one session. It is a preview of what the NCSC's own guidance on agentic AI has been telling UK boards for months: least privilege and monitoring now have to assume the thing behind an authenticated session might not be a person at all.

Sources