Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances

CVE-2026-85102 is an improper certificate trust-validation flaw (CWE-295) in the VPN negotiation code of Check Point Quantum Security Gateways. An unauthenticated remote attacker who can reach the gateway's VPN service can trigger the flaw during VPN negotiation, where certificates involved in the exchange are not properly validated, and achieve code execution on the gateway. Successful exploitation yields arbitrary code execution on the gateway with high impact on confidentiality, integrity, and availability (CVSS 9.8), amounting to full compromise of the security gateway. The affected population is organizations running Quantum Security Gateways with VPN services reachable from untrusted networks. As of the available reporting there is no public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation is confirmed; the issue was disclosed alongside a second, similarly rated (9.8) Check Point VPN certificate-validation RCE flaw.

Do: Upgrade Quantum Security Gateways to the fixed versions listed in Check Point's advisory (AV26-902) as soon as they are published, prioritizing internet-facing VPN gateways. Until patched, restrict exposure of VPN negotiation endpoints to trusted networks and monitor VPN services for anomalous handshake activity. Inventory which gateways in your estate expose VPN services publicly and treat those as the highest-priority targets.

This vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server, achieving high confidentiality, integrity, and availability through directory traversal and file upload attacks. An attacker can leverage this flaw to compromise sensitive systems and gain extensive control over the management environment. The affected scope includes all Check Point Management Server installations, with no specific version range identified in the provided data.

Do: Upgrade to patched Check Point Management Server versions immediately; disable/block directory traversal and file upload features; audit all management server deployments and verify plugin installation status; monitor for new CVEs and update policies.

An improper input validation flaw (CWE-20) in the on-premises VeloCloud Orchestrator (VCO) allows a remote, unauthenticated attacker to reach privileged internal functionality on the orchestrator host. Exploitation occurs over the network with no credentials or user interaction (attack complexity is high), and success compromises the confidentiality, integrity, and availability of the orchestrator and the data it manages; the CVSS 4.0 vector also flags high impact on subsequent systems, meaning the SD-WAN edges and sites the orchestrator controls are at risk. Affected deployments are customer-operated on-prem VCO installations, while the vendor-hosted (including Dedicated) VCO service was also impacted but has already been patched. No public proof of concept or in-the-wild exploitation has been reported, and the issue is not on CISA's KEV list.

Do: Update on-prem VCO to the fixed release specified in the Arista/Broadcom security advisory as soon as possible. Until patched, remove internet exposure by placing the orchestrator behind a VPN or IP allowlist, and audit logs for unauthenticated or anomalous API requests. Confirm hosted/Dedicated tenancies are on the current patched build and review managed edge devices for unauthorized configuration changes.

F5 BIG-IP Access Policy Manager (APM) contains a heap-based buffer overflow (CWE-122) that is reachable when a virtual server has both an APM access policy and an OAuth profile configured. An unauthenticated remote attacker can send specifically crafted malicious traffic to such a virtual server and achieve remote code execution on the BIG-IP system, which fully compromises the confidentiality, integrity, and availability of the traffic-management device. Systems running in Appliance mode are also vulnerable, and because this is a data plane flaw, the exposure is at the virtual server itself rather than the management control plane. The vulnerability is rated critical (CVSS 4.0: 9.3) with no privileges or user interaction required. No public proof-of-concept or confirmed in-the-wild exploitation is known, and F5 has not evaluated software versions that have reached End of Technical Support.

Do: Inventory virtual servers with an APM access policy plus an OAuth profile and prioritize patching those first, applying the fixed release identified in F5's advisory (EoTS versions must be upgraded to a supported release to receive a fix). Until patched, remove the OAuth profile from internet-facing virtual servers where feasible or restrict access to the virtual server so untrusted sources cannot reach the APM listener. Monitor BIG-IP logs for anomalous traffic to APM-enabled virtual servers, since exploitation would not touch the management plane.