U.S. CISA adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog
CISA added four actively exploited Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its KEV catalog, with federal fixes due September 25.
CISA added CVE-2026-85102 (Check Point VPN certificate validation bypass), CVE-2026-93616 (Check Point Security Management Server path traversal), CVE-2026-93952 (Arista VeloCloud Orchestrator input validation), and CVE-2026-94127 (F5 BIG-IP APM heap buffer overflow) to the KEV catalog. Check Point stated CVE-2026-93616 is exploited in the wild with a handful of customers already attacked, and F5 confirmed exploitation of CVE-2026-94127 against APM OAuth Authorization Server configurations. Federal agencies must remediate by September 25, 2026 under BOD 22-01. Check Point has shipped LivePatch/Jumbo Hotfixes and an R82.20 Security Hotfix, plus IOCs for detection.
- Four flaws added to KEV; FCEB agencies must patch by September 25, 2026.
- Check Point says CVE-2026-93616 is exploited in the wild; several customers already attacked.
- CVE-2026-94127 lets unauthenticated RCE on BIG-IP APM acting as OAuth Authorization Server.
- Affected Check Point products include Management, Multi-Domain, Log Servers, and SmartEvent; R82.20 not affected by CVE-2026-85102.
- On-premises VeloCloud Orchestrator deployments must apply updates; hosted VCO already patched.
- Organizations
- CISACheck PointAristaF5NCSC-NL
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-93616 | Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload | 9.8 | 92% | KEVPoC | KEV |
| CVE-2026-93952 | Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem) | 9.5 | 1% | KEV | KEV |
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 27% | KEVPoC ×2 | KEV |
From the original article
3 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.