Reporting snapshot: September 23, 2026. Check vendor advisories for later changes to affected versions and fixes.
What happened
On September 22, CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog after finding evidence of exploitation. The affected products are Check Point Security Gateway and Security Management, Arista VeloCloud Orchestrator on-premises, and F5 BIG-IP Access Policy Manager (APM). A KEV listing is an exploitation signal; it does not mean every installation of these products is vulnerable or compromised.
- CVE-2026-85102 — Check Point gateway and Spark firewall: improper certificate validation during VPN negotiation can allow unauthenticated remote code execution on affected systems. Check Point reports exploitation attempts and says a fix has been available since September 9.
- CVE-2026-93616 — Check Point Security Management: a pre-authentication path traversal flaw in the management web service can lead to script execution. Check Point reports limited exploitation and says fixes are available; its LivePatch Takes 28 and 29 do not address this flaw.
- CVE-2026-93952 — Arista VeloCloud Orchestrator: improper input validation may expose privileged internal functionality and the on-premises orchestrator host. Arista says the issue is actively exploited and lists affected release trains, fixed versions where available, access restrictions, and signs to investigate.
- CVE-2026-94127 — F5 BIG-IP APM: a heap-based buffer overflow can allow unauthenticated code execution when an APM access policy and an OAuth profile are configured on the same virtual server. F5 reports exploitation; the Canadian Centre for Cyber Security lists fixed hotfix releases and log-review steps.
What to do
- Inventory these specific products, versions, and required configurations. Identify systems with reachable VPN, management, or APM interfaces.
- Follow the matching vendor advisory for the applicable fix or temporary mitigation. Restrict management access to trusted administrative networks while planning the change.
- Review logs and configuration changes for suspicious activity before and after patching. Preserve evidence and use the incident-response process if compromise is suspected; patching alone does not remove an intruder.
- If none of these products is present, record that result and continue normal vulnerability monitoring. Do not treat the four CVE numbers as four affected devices.
Original sources
CISA: four KEV additions, September 22
Check Point: affected products, exploitation, and fixes
Arista Security Advisory 0183
Canadian Centre for Cyber Security: F5 BIG-IP APM alert
F5 vendor advisory K000162605
Panther Note
When a security gateway or its management system is on an exploited-vulnerability list, verify exposure first, apply the relevant fix, and check whether the system was touched before the fix. The evidence should determine the urgency and the next action.