CISA’s addition of four vulnerabilities to its Known Exploited Vulnerabilities Catalog on September 22, 2026 deserves particular attention because all four affect systems that sit at highly privileged points within enterprise networks.

The newly added vulnerabilities are:

  • CVE-2026-85102 – Check Point Security Gateway improper certificate validation
  • CVE-2026-93616 – Check Point Security Management path traversal
  • CVE-2026-93952 – Arista VeloCloud Orchestrator improper input validation
  • CVE-2026-94127 – F5 BIG-IP APM heap-based buffer overflow

Inclusion in CISA’s KEV Catalog means these are not simply theoretically exploitable vulnerabilities. Evidence of exploitation in real-world attacks exists.

That distinction should fundamentally change patching priority.

Organizations frequently manage thousands of vulnerabilities and cannot remediate every CVE immediately. A KEV entry provides something CVSS alone cannot: evidence that attackers are already successfully using the vulnerability.

CVE-2026-85102: Check Point VPN gateways under active attack

CVE-2026-85102 affects Check Point Security Gateway and Spark Firewall products.

The vulnerability results from improper validation of certificate information during VPN negotiation and can allow an unauthenticated remote attacker to execute arbitrary code on the security gateway.

Check Point rates the flaw at CVSS 9.8.

The company originally disclosed the vulnerability and released fixes on September 9. At that point, no exploitation had been identified.

That situation changed rapidly.

Check Point subsequently observed exploitation attempts beginning on September 12 against Spark customers globally.

The attacks reportedly used certificates with subjects including:

CN=vpn,OU=users,O=global

CN=vpn-user,OU=users,O=global

CN=vpnuser,OU=users,O=global

These indicators should be useful for threat hunting, but defenders should not limit detection exclusively to those exact certificate subjects.

Attackers can modify certificate attributes easily.

The more important detection opportunity is unusual certificate-based VPN authentication combined with unexpected follow-on activity.

Check Point specifically recommends reviewing Mobile Access logs for anomalous certificate authentication and watching for secondary activity such as internal port or service scanning.

Why compromising a security gateway is especially dangerous

A firewall or VPN appliance is fundamentally different from an ordinary endpoint.

It often sits directly at the boundary between trusted and untrusted networks and may have visibility into, or access to, multiple internal segments.

Successful exploitation may therefore give attackers an unusually advantageous foothold.

Depending on the device configuration and access obtained, attackers could potentially:

  • establish persistent remote access;
  • perform internal reconnaissance;
  • reach systems not directly exposed to the Internet;
  • manipulate network or security configuration;
  • use the appliance as infrastructure for subsequent attacks; or
  • conceal malicious traffic behind a trusted network device.

Not every capability has necessarily been demonstrated in exploitation of CVE-2026-85102, but the strategic position of a compromised gateway makes rapid remediation particularly important.

CVE-2026-93616: Check Point Security Management zero-day

The second Check Point vulnerability, CVE-2026-93616, is arguably even more concerning from an architectural perspective.

It is a pre-authentication path traversal vulnerability affecting Check Point Security Management.

According to Check Point, exploitation can allow an unauthenticated attacker to execute scripts from arbitrary filesystem locations and load arbitrary Java classes.

The flaw is rated CVSS 9.8.

Check Point says it observed a small number of targeted attacks on July 23, 2026, meaning exploitation occurred before the vulnerability was publicly disclosed.

That makes CVE-2026-93616 a zero-day in the conventional sense: attackers were exploiting it before defenders had a public patch or advisory.

Why compromising the management server may have wider consequences

A security management platform is a highly sensitive component.

It is responsible for managing security policies, objects, gateways, logs and administrative configuration.

Even if individual firewalls themselves are not directly vulnerable to CVE-2026-93616, compromise of the management infrastructure can still create broader risk.

An attacker with sufficient access to a central management system could potentially manipulate objects, policies or configuration subsequently distributed to managed devices.

Organizations therefore should not treat this merely as compromise of another server.

Security-management systems effectively form part of the control plane for the broader security infrastructure.

Important remediation detail for Check Point users

Check Point has released fixes for both vulnerabilities.

For CVE-2026-93616, organizations should pay close attention to the exact Jumbo Hotfix level running on affected management systems.

Check Point also notes that earlier LivePatch releases do not address this vulnerability.

Administrators should verify the actual installed fix rather than assuming that the presence of LivePatch automatically means the system is protected.

This is one of those small operational details that tends to become disproportionately important several days later during incident response.

CVE-2026-93952: VeloCloud Orchestrator compromise threatens the SD-WAN control plane

The third KEV entry, CVE-2026-93952, affects on-premises VeloCloud Orchestrator deployments.

Arista rates the vulnerability at CVSS 10.0 under CVSS v3.1.

Successful exploitation may allow a remote attacker to access privileged internal functionality and compromise the confidentiality, integrity and availability of both the Orchestrator and the data it manages.

Arista has confirmed that the vulnerability is being actively exploited.

Hosted and dedicated VCO environments were also affected, but Arista states those environments have already been patched.

The immediate operational concern therefore falls primarily on organizations running their own on-premises VCO deployments.

Why SD-WAN orchestration is a valuable target

A centralized SD-WAN orchestrator is an attractive target because it manages large numbers of geographically distributed edge devices.

Compromise potentially gives an attacker visibility into:

  • network topology;
  • branch devices;
  • configuration;
  • certificates;
  • credentials;
  • administrative information; and
  • communications between managed infrastructure.

Arista has explicitly warned that compromise of the Orchestrator may also expose managed VeloCloud Edge devices.

This changes the risk calculation substantially.

An attacker who compromises an ordinary branch endpoint controls one machine.

An attacker who compromises the orchestration platform may gain leverage over the infrastructure connecting multiple branches.

CVE-2026-94127: F5 BIG-IP APM unauthenticated RCE

The fourth vulnerability, CVE-2026-94127, affects F5 BIG-IP Access Policy Manager.

It is a heap-based buffer overflow rated CVSS 9.8.

The vulnerability is exploitable under a specific configuration: an affected BIG-IP virtual server must have both an APM access policy and an OAuth profile configured.

Under those conditions, specially crafted network traffic can allow an unauthenticated attacker to execute arbitrary code.

F5 has confirmed exploitation in the wild.

Data-plane RCE is still extremely serious

F5 notes that CVE-2026-94127 is a data-plane issue rather than direct control-plane exposure.

That distinction is technically important, but it should not be interpreted as meaning the vulnerability is low risk.

An attacker who obtains remote code execution on a network appliance may still gain substantial control over the affected system and potentially use it to expand access.

BIG-IP deployments are commonly used for:

  • remote access;
  • authentication;
  • application delivery;
  • access control;
  • traffic management; and
  • identity-related workflows.

Compromising such infrastructure can therefore create consequences far beyond the individual vulnerable process.

F5 has provided fixed hotfixes

F5 has issued engineering hotfixes for affected versions in the 17.1, 17.5 and 21.1 branches.

Organizations should identify systems where both an APM access policy and OAuth profile are configured and prioritize those appliances for remediation.

CISA’s KEV record also recommends applying F5’s vendor-provided iRule as a temporary mitigation while performing forensic triage, followed by installation of the final vendor patch.

These four vulnerabilities share an important characteristic

Although the technical bugs differ considerably, the affected products have something in common:

They are security or network-control infrastructure.

The four vulnerabilities affect:

VPN gateway → Security management server → SD-WAN orchestrator → Application access gateway

That is an uncomfortable sequence for defenders.

These systems often sit in trusted zones, possess privileged credentials and are intentionally reachable by users or administrators.

They may also receive less endpoint-style monitoring than conventional Windows or Linux servers.

This makes them attractive attack targets.

CVSS alone is not enough

Another important lesson from this CISA update is that vulnerability prioritization should not be based exclusively on CVSS.

All four vulnerabilities are severe, but the decisive signal is that exploitation is already occurring.

A theoretical CVSS 10.0 vulnerability affecting an isolated internal system may represent less immediate risk than a CVSS 8.0 vulnerability being actively exploited against an Internet-facing appliance.

A mature vulnerability-management process should therefore combine:

  • CVSS severity;
  • CISA KEV status;
  • Internet exposure;
  • asset criticality;
  • exploit availability;
  • observed threat activity;
  • privileges available after exploitation; and
  • compensating controls.

Patching should be accompanied by threat hunting

Organizations should also avoid treating patch deployment as proof that no compromise occurred.

Several of these vulnerabilities were exploited before or shortly after public disclosure.

Security teams should therefore investigate vulnerable systems for signs of activity that occurred before patching.

For Check Point systems, this may include:

  • unusual certificate-based VPN authentication;
  • internal reconnaissance;
  • unexpected administrative activity;
  • suspicious script execution; and
  • anomalous connections originating from gateways or management servers.

For VeloCloud Orchestrator, organizations should examine:

  • unexpected processes or files;
  • unusual outbound HTTP or HTTPS traffic;
  • administrator activity;
  • configuration changes; and
  • access to certificates or credentials.

For F5 BIG-IP APM, defenders should review:

  • unusual OAuth authentication failures;
  • abnormal access-policy activity;
  • unexpected processes;
  • configuration changes; and
  • suspicious network connections.

Network appliances need endpoint-style monitoring

A recurring weakness in enterprise security architecture is that organizations monitor employee laptops extensively but provide comparatively little behavioral visibility into appliances.

That model is increasingly difficult to defend.

Firewalls, VPN gateways, load balancers and orchestration platforms are essentially specialized computers.

They run operating systems.

They execute processes.

They store configuration and credentials.

They communicate across networks.

And attackers know that.

Organizations should therefore centralize their appliance logs, monitor outbound connections and establish baselines for normal administrative activity.

Internet exposure should be minimized

Management interfaces should not be broadly reachable simply because that configuration is convenient.

Organizations should restrict administrative interfaces to:

  • dedicated management networks;
  • trusted jump hosts;
  • approved source addresses;
  • VPN-protected administrative paths; or
  • similarly controlled access mechanisms.

Segmentation is particularly important.

A compromised endpoint should not automatically be able to communicate with firewall management, SD-WAN orchestration and load-balancer administration interfaces.

The CISA deadline is unusually short

The four entries were added on September 22 with a CISA remediation due date of September 25, 2026 for organizations subject to the applicable federal directive.

That three-day window illustrates how CISA views the risk associated with actively exploited vulnerabilities in critical infrastructure components.

Private-sector organizations are not automatically bound by that federal deadline, but the timeline is still a useful risk signal.

Attackers will not wait for the next convenient quarterly maintenance window merely because change-control paperwork has not finished circulating.

The broader cybersecurity lesson

This CISA update highlights a continuing shift in attacker targeting.

Instead of fighting through endpoint defenses one workstation at a time, attackers increasingly target systems that already possess the privileges and network reach they want.

Security gateways provide perimeter access.

Management platforms control security policy.

SD-WAN orchestrators manage distributed networks.

Access gateways control authentication and application access.

Compromising these systems can potentially deliver significantly more leverage than compromising a single endpoint.

The four September 22 KEV additions therefore reinforce a simple but increasingly important principle:

Security infrastructure must itself be treated as high-value attack surface.

Firewalls, VPN appliances, load balancers and management controllers cannot be assumed trustworthy merely because their purpose is to protect other systems.

They require rapid patching, restricted access, behavioral monitoring, centralized logging and routine threat hunting just like the infrastructure they were deployed to defend.

And when CISA moves a vulnerability into KEV, the discussion should generally shift from “Could somebody exploit this?” to “Has somebody already tried this against us?”

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerability CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catal

Source: CISA Adds Four Known Exploited Vulnerabilities to Catalog via CISA Advisories — published 22 Sep 2026.