CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited Check Point, Arista VeloCloud, and F5 BIG-IP flaws to the KEV catalog.
On 2026-09-22, CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. They are CVE-2026-85102 (Check Point improper certificate validation), CVE-2026-93616 (Check Point path traversal), CVE-2026-93952 (Arista VeloCloud Orchestrator improper input validation), and CVE-2026-94127 (F5 BIG-IP APM heap-based buffer overflow). Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of high-risk KEV entries on exposed assets. CISA encourages all organizations to remediate these cataloged flaws quickly.
- CISA added four CVEs to the KEV catalog for active exploitation.
- Check Point flaws are certificate validation and path traversal issues.
- Arista VeloCloud Orchestrator has an improper input validation flaw.
- F5 BIG-IP APM has a heap-based buffer overflow; BOD 26-04 applies to FCEB agencies.
- Vendors
- Check PointAristaF5
- Products
- BIG-IP APMVeloCloud Orchestrator
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-93616 | Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload | 9.8 | 92% | KEVPoC | KEV |
| CVE-2026-93952 | Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem) | 9.5 | 1% | KEV | KEV |
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
From the original article
1 min read at cisa.govCISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.