Skip to content
Today
Sections

Security Independently confirmed2 publishers 2 min read Published

CISA orders agencies to fix four exploited edge-network flaws by September 25

Check Point says a handful of its customers have already been attacked through the Security Management Server, and F5 confirmed exploitation of BIG-IP APM when it disclosed the bug on September 22.

The Watch · Security desk

Send a correction

Illustration accompanying CISA orders agencies to fix four exploited edge-network flaws by September 25
Generated illustration

What happened

  • CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on evidence of active exploitation: two in Check Point products, one in Arista VeloCloud Orchestrator, one in F5 BIG-IP APM.
  • CVE-2026-85102 sits in Check Point's VPN negotiation process and lets an unauthenticated attacker bypass security checks and run code on the gateway.
  • CVE-2026-93616 is a path traversal in Check Point's Security Management Server that lets an attacker who never logs in upload a malicious script and execute it on the server.
  • CVE-2026-94127 gives an unauthenticated attacker arbitrary code execution on BIG-IP, but only where APM is configured as an OAuth authorization server.
  • CISA has ordered federal agencies to fix all four vulnerabilities by September 25, 2026.

Why it matters

  • Who's exposed exposure The Security Management Server holds security policy, admin activity and system logs for the gateways beneath it, so one unauthenticated upload reaches every device it manages.
  • Who has to decide decision R80 through R81.10 are affected and out of support, and the named remedies cover supported versions, so those operators pick between an upgrade project and an exposed VPN gateway.
  • What doesn't add up contradiction SecurityAffairs attributes the remediation obligation to BOD 22-01, while CISA's own alert names BOD 26-04 as the directive setting FCEB requirements.
  • What's now possible capability Check Point published indicators of compromise, so a customer can test logs and open an incident before the hotfix closes the door behind an intruder.

Check Point shipped its gateway fixes on September 9, in advisories sk1000117 and sk1000118 [14]. That leaves 16 days before the federal due date for estates that were already tracking those advisories [23], and three days for anyone whose first notice of the BIG-IP bug was F5's September 22 disclosure [9][24]. The Dutch NCSC had warned in mid-September that the Check Point VPN flaw could soon be actively exploited [13].

BOD 26-04 asks for more than installed hotfixes. It tells FCEB agencies to prioritize KEV entries on publicly exposed assets that grant total control after exploitation, and it sets expectations for when an agency must check whether a threat actor compromised the system before the patch went on [21]. All four entries here are code execution or privileged access on a device built to face the internet [12][3][18][9].

On the Management Server bug, Check Point said the flaw "is exploited in the wild" [6]. The company also said the real total may be higher, because some compromises go undetected or are never reported to it [7]. The fix is the R82.20 Security Hotfix [5]. The affected list runs past the main Security Management Server to Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent [4].

The F5 bug is narrower than the class name suggests. CVE-2026-94127 requires APM running an access policy together with an OAuth profile on a virtual server, with APM acting as the OAuth authorization server; installs using APM only as an OAuth client or resource server are not affected [10]. Triage starts with the virtual server configs.

VeloCloud Orchestrator is the thinnest of the four on the public record. CISA lists CVE-2026-93952 as improper input validation [2], and SecurityAffairs describes it as letting a remote attacker reach privileged internal functionality and affect the VCO host [18]. Hosted environments, including Dedicated, were affected and have already been patched [19]. The exposed population is on-premises, and neither source names who is exploiting it.

What to watch

  • Whether Arista or CISA publishes exploitation detail for CVE-2026-93952, the thinnest of the four entries on the public record.
  • Whether Check Point offers a fix path for the end-of-support R80 through R81.10 releases affected by CVE-2026-85102.
  • Whether agencies document the BOD 26-04 pre-patch compromise checks after September 25, alongside the hotfix installs.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence78
Adoption55
Hype gap−8
Incentives62
Confidence72
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation.

    Reported SupportedView cited source
  2. [2]

    The four additions are CVE-2026-85102 (Check Point Multiple Products Improper Certificate Validation), CVE-2026-93616 (Check Point Multiple Products Path Traversal), CVE-2026-93952 (Arista VeloCloud Orchestrator Improper Input Validation) and CVE-2026-94127 (F5 BIG-IP APM Heap-based Buffer Overflow).

    Reported SupportedView cited source
  3. [3]

    CVE-2026-93616 is a critical path traversal flaw in Check Point's Security Management Server; attackers can abuse it without logging in to upload malicious scripts and execute them on vulnerable servers.

    Reported SupportedView cited source
  4. [4]

    The products impacted by CVE-2026-93616 include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent.

    Reported SupportedView cited source
  5. [5]

    Check Point fixed CVE-2026-93616 in the R82.20 Security Hotfix and is urging customers to act quickly.

    Reported SupportedView cited source
  6. [6]

    Check Point revealed the flaw "is exploited in the wild" and that it is aware of a handful of customers who have already been attacked.

    Reported Supported Source: Check PointView cited source
  7. [7]

    The actual number of victims could be higher, since some compromises may go undetected or never be reported to Check Point.

    Reported SupportedView cited source
  8. [8]

    The Management Server controls security policies, admin activity and system logs across Check Point deployments, so a compromise could have a wider impact on an enterprise network.

    Reported SupportedView cited source
  9. [9]

    CVE-2026-94127 affects BIG-IP Access Policy Manager and allows an unauthenticated attacker to execute arbitrary code; F5 disclosed the issue on September 22 and confirmed that exploitation had already been observed.

    Reported Supported Source: F5View cited source
  10. [10]

    The vulnerable BIG-IP configuration uses an access policy together with an OAuth profile on a virtual server, with APM operating as an OAuth Authorization Server; systems using APM only as an OAuth Client or Resource Server are not affected.

    Reported SupportedView cited source
  11. [11]

    SecurityAffairs states that under Binding Operational Directive 22-01, FCEB agencies have to address the identified vulnerabilities by the due date.

    Reported Supported Source: SecurityAffairsView cited source
  12. [12]

    CVE-2026-85102 resides in the VPN negotiation process and lets an unauthenticated attacker bypass security checks and run their own code on the gateway.

    Reported SupportedView cited source
  13. [13]

    In mid-September the Dutch NCSC warned that the critical Check Point flaw could soon be actively exploited.

    Reported Supported Source: Dutch NCSC, as reported by SecurityAffairsView cited source
  14. [14]

    Check Point addressed the flaws on September 9 with the release of advisories sk1000117 and sk1000118.

    Reported SupportedView cited source
  15. [15]

    The affected releases span R81.20, R82, R82.10, R81.10.x and R82.00.x, plus end-of-support versions from R80 through R81.10; R82.20 is not affected.

    Reported SupportedView cited source
  16. [16]

    For supported versions, Check Point provides fixes through LivePatch Take 24 or specific Jumbo Hotfix updates, depending on the version in use.

    Reported SupportedView cited source
  17. [17]

    Check Point has published indicators of compromise in its advisory, giving security teams a way to check their systems and logs for signs of an attack.

    Reported SupportedView cited source
  18. [18]

    CVE-2026-93952 affects VeloCloud Orchestrator on-premises deployments and may let a remote attacker access privileged internal functionality and impact the VCO host, compromising confidentiality, integrity and availability of the orchestrator and its data.

    Reported SupportedView cited source
  19. [19]

    Hosted VCO environments, including Dedicated versions, were also affected but have already been patched.

    Reported SupportedView cited source
  20. [20]

    CISA orders federal agencies to fix the flaws by September 25, 2026.

    Reported SupportedView cited source
  21. [21]

    BOD 26-04 requires FCEB agencies to prioritize rapid remediation of KEV Catalog CVEs on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities, and establishes expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

    Reported SupportedView cited source
  22. [22]

    CISA encourages all organizations, not only FCEB agencies, to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.

    Reported SupportedView cited source
  23. [23]

    Check Point customers had 16 days between the September 9 fix release and the September 25 federal due date.

    Derived Supported
  24. [24]

    F5 BIG-IP APM operators had three days between F5's September 22 disclosure and the September 25 federal due date.

    Derived Supported

Sources

2 independent publishers whose own reporting we read for this story.

  1. cisa.gov

    1 article · September 22, 2026

    CISA Adds Four Known Exploited Vulnerabilities to Catalog
  2. securityaffairs.com

    1 article · September 23, 2026

    U.S. CISA adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog

Topics and entities

Topics

Entities