CISA lists exploited Check Point, F5, and Arista flaws

CISA added four actively exploited Check Point, F5 BIG-IP APM, and Arista VeloCloud flaws to KEV, with federal fixes due September 25, 2026.

CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog on September 22, 2026—Check Point CVE-2026-85102 and CVE-2026-93616, F5 BIG-IP APM CVE-2026-94127, and Arista VeloCloud Orchestrator CVE-2026-93952—with a federal civilian deadline of September 25, 2026. Reports disagree on the binding directive, naming either BOD 22-01 or BOD 26-04. CVE-2026-85102 (CVSS 9.8) is improper VPN certificate validation that allows unauthenticated code execution on Security Gateway and Spark Firewall; it was patched on September 9, 2026, Spark exploitation attempts began September 12, and R82.20 is not affected. CVE-2026-93616 (CVSS 9.8) is a pre-authentication path-traversal and file-upload flaw in Security Management, Multi-Domain Management, log servers, and SmartEvent that can upload scripts and, one report says, load an arbitrary Java class; targeted activity was seen on July 23, a handful of customers were attacked, LivePatch Takes 28 and 29 do not fix it, and Smart-1 Cloud, firewall appliances, and Spark are not affected. CVE-2026-94127 (CVSS 9.8), disclosed in F5 advisory K000162605, is an unauthenticated heap overflow in APM configured as an OAuth authorization server and was exploited before patches; hotfixes cover the 21.x, 17.5.x, and 17.1.x branches, including cited builds 21.1.0, 17.5.1, and 17.1.3, an iRule is an interim mitigation, other BIG-IP modules and BIG-IQ are unaffected, and Shadowserver reports more than 15,000 internet-exposed BIG-IP APM systems. Hosted VeloCloud Orchestrator is already patched for CVE-2026-93952 while on-premises deployments still need updates, and CISA has not tied the Check Point flaws to ransomware.