Security 2 publishers2 min readPublished September 23, 2026 at 3:32 PM PDT

CISA orders agencies to fix four exploited edge-network flaws by September 25

Check Point says a handful of its customers have already been attacked through the Security Management Server, and F5 confirmed exploitation of BIG-IP APM when it disclosed the bug on September 22.

The Watch · Security desk

Illustration accompanying CISA orders agencies to fix four exploited edge-network flaws by September 25

What happened

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on evidence of active exploitation: two in Check Point products, one in Arista VeloCloud Orchestrator, one in F5 BIG-IP APM.
CVE-2026-85102 sits in Check Point's VPN negotiation process and lets an unauthenticated attacker bypass security checks and run code on the gateway.
CVE-2026-93616 is a path traversal in Check Point's Security Management Server that lets an attacker who never logs in upload a malicious script and execute it on the server.
CVE-2026-94127 gives an unauthenticated attacker arbitrary code execution on BIG-IP, but only where APM is configured as an OAuth authorization server.
CISA has ordered federal agencies to fix all four vulnerabilities by September 25, 2026.

Compiled by The WatchSomething wrong?How this is made

Why it matters

exposure The Security Management Server holds security policy, admin activity and system logs for the gateways beneath it, so one unauthenticated upload reaches every device it manages.
decision R80 through R81.10 are affected and out of support, and the named remedies cover supported versions, so those operators pick between an upgrade project and an exposed VPN gateway.
contradiction SecurityAffairs attributes the remediation obligation to BOD 22-01, while CISA's own alert names BOD 26-04 as the directive setting FCEB requirements.
capability Check Point published indicators of compromise, so a customer can test logs and open an incident before the hotfix closes the door behind an intruder.

Check Point shipped its gateway fixes on September 9, in advisories sk1000117 and sk1000118 ^[5]. That leaves 16 days before the federal due date for estates that were already tracking those advisories ^[23], and three days for anyone whose first notice of the BIG-IP bug was F5's September 22 disclosure ^[17]^[24]. The Dutch NCSC had warned in mid-September that the Check Point VPN flaw could soon be actively exploited ^[4].

BOD 26-04 asks for more than installed hotfixes. It tells FCEB agencies to prioritize KEV entries on publicly exposed assets that grant total control after exploitation, and it sets expectations for when an agency must check whether a threat actor compromised the system before the patch went on ^[20]. All four entries here are code execution or privileged access on a device built to face the internet ^[3]^[8]^[15]^[17].

On the Management Server bug, Check Point said the flaw "is exploited in the wild" ^[11]. The company also said the real total may be higher, because some compromises go undetected or are never reported to it ^[12]. The fix is the R82.20 Security Hotfix ^[10]. The affected list runs past the main Security Management Server to Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent ^[9].

The F5 bug is narrower than the class name suggests. CVE-2026-94127 requires APM running an access policy together with an OAuth profile on a virtual server, with APM acting as the OAuth authorization server; installs using APM only as an OAuth client or resource server are not affected ^[18]. Triage starts with the virtual server configs.

VeloCloud Orchestrator is the thinnest of the four on the public record. CISA lists CVE-2026-93952 as improper input validation ^[2], and SecurityAffairs describes it as letting a remote attacker reach privileged internal functionality and affect the VCO host ^[15]. Hosted environments, including Dedicated, were affected and have already been patched ^[16]. The exposed population is on-premises, and neither source names who is exploiting it.

What to watch

Whether Arista or CISA publishes exploitation detail for CVE-2026-93952, the thinnest of the four entries on the public record.
Whether Check Point offers a fix path for the end-of-support R80 through R81.10 releases affected by CVE-2026-85102.
Whether agencies document the BOD 26-04 pre-patch compromise checks after September 25, alongside the hotfix installs.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation.
ReportedSupported2 sources— sign in to open View cited source
[2]
The four additions are CVE-2026-85102 (Check Point Multiple Products Improper Certificate Validation), CVE-2026-93616 (Check Point Multiple Products Path Traversal), CVE-2026-93952 (Arista VeloCloud Orchestrator Improper Input Validation) and CVE-2026-94127 (F5 BIG-IP APM Heap-based Buffer Overflow).
ReportedSupported2 sources— sign in to open View cited source
[8]
CVE-2026-93616 is a critical path traversal flaw in Check Point's Security Management Server; attackers can abuse it without logging in to upload malicious scripts and execute them on vulnerable servers.
ReportedSupported2 sources— sign in to open View cited source
[9]
The products impacted by CVE-2026-93616 include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent.
ReportedSupported2 sources— sign in to open View cited source
[10]
Check Point fixed CVE-2026-93616 in the R82.20 Security Hotfix and is urging customers to act quickly.
ReportedSupported2 sources— sign in to open View cited source
[11]
Check Point revealed the flaw "is exploited in the wild" and that it is aware of a handful of customers who have already been attacked.
ReportedSupportedSource: Check Point2 sources— sign in to open View cited source
[12]
The actual number of victims could be higher, since some compromises may go undetected or never be reported to Check Point.
ReportedSupported2 sources— sign in to open View cited source
[14]
The Management Server controls security policies, admin activity and system logs across Check Point deployments, so a compromise could have a wider impact on an enterprise network.
ReportedSupported2 sources— sign in to open View cited source
[17]
CVE-2026-94127 affects BIG-IP Access Policy Manager and allows an unauthenticated attacker to execute arbitrary code; F5 disclosed the issue on September 22 and confirmed that exploitation had already been observed.
ReportedSupportedSource: F52 sources— sign in to open View cited source
[18]
The vulnerable BIG-IP configuration uses an access policy together with an OAuth profile on a virtual server, with APM operating as an OAuth Authorization Server; systems using APM only as an OAuth Client or Resource Server are not affected.
ReportedSupported2 sources— sign in to open View cited source
[22]
SecurityAffairs states that under Binding Operational Directive 22-01, FCEB agencies have to address the identified vulnerabilities by the due date.
ReportedSupportedSource: SecurityAffairs2 sources— sign in to open View cited source
[3]
CVE-2026-85102 resides in the VPN negotiation process and lets an unauthenticated attacker bypass security checks and run their own code on the gateway.
ReportedSupportedView cited source
[4]
In mid-September the Dutch NCSC warned that the critical Check Point flaw could soon be actively exploited.
ReportedSupportedSource: Dutch NCSC, as reported by SecurityAffairsView cited source
[5]
Check Point addressed the flaws on September 9 with the release of advisories sk1000117 and sk1000118.
ReportedSupportedView cited source
[6]
The affected releases span R81.20, R82, R82.10, R81.10.x and R82.00.x, plus end-of-support versions from R80 through R81.10; R82.20 is not affected.
ReportedSupportedView cited source
[7]
For supported versions, Check Point provides fixes through LivePatch Take 24 or specific Jumbo Hotfix updates, depending on the version in use.
ReportedSupportedView cited source
[13]
Check Point has published indicators of compromise in its advisory, giving security teams a way to check their systems and logs for signs of an attack.
ReportedSupportedView cited source
[15]
CVE-2026-93952 affects VeloCloud Orchestrator on-premises deployments and may let a remote attacker access privileged internal functionality and impact the VCO host, compromising confidentiality, integrity and availability of the orchestrator and its data.
ReportedSupportedView cited source
[16]
Hosted VCO environments, including Dedicated versions, were also affected but have already been patched.
ReportedSupportedView cited source
[19]
CISA orders federal agencies to fix the flaws by September 25, 2026.
ReportedSupportedView cited source
[20]
BOD 26-04 requires FCEB agencies to prioritize rapid remediation of KEV Catalog CVEs on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities, and establishes expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
ReportedSupportedView cited source
[21]
CISA encourages all organizations, not only FCEB agencies, to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.
ReportedSupportedView cited source
[23]
Check Point customers had 16 days between the September 9 fix release and the September 25 federal due date.
DerivedSupported2 sources— sign in to open
[24]
F5 BIG-IP APM operators had three days between F5's September 22 disclosure and the September 25 federal due date.
DerivedSupported2 sources— sign in to open

Sources

Publishers with included, body-backed reporting in this cluster.

cisa.gov
1 article · September 22, 2026
CISA Adds Four Known Exploited Vulnerabilities to Catalog
securityaffairs.com
1 article · September 23, 2026
U.S. CISA adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Exposure here is version-specific and configuration-specific. Check Point's certificate validation bug touches R81.20, R82, R82.10 and the R81.10.x and R82.00.x trains, plus end-of-support builds back to R80; R82.20 is clear, and the remedy is LivePatch Take 24 or a Jumbo Hotfix matched to the release in use. F5's heap overflow only reaches deployments where APM acts as an OAuth Authorization Server, with an access policy and OAuth profile on a virtual server. An APM box used purely as an OAuth client or resource server is out of scope. The path traversal offers no such escape: no login is needed, and it covers Security Management Server, the multi-domain variants, Log Server and SmartEvent. Only SecurityAffairs carries any of this.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence78

0100

Primary agency notice plus vendor advisories

One of the two accounts is the issuing agency, which settles the identifiers, the directive and the deadline. SecurityAffairs carries the vendor material: Check Point's September 9 advisory numbers, the R82.20 Security Hotfix, F5's September 22 disclosure, and the OAuth configuration that decides whether a BIG-IP box is in scope. The weak link is the victim count, which rests on Check Point's own phrase, "a handful of customers", relayed without independent confirmation.

Adoption55

0100

Exploitation confirmed, scale unstated

Three parties put these bugs in live use: the catalog listing requires evidence of exploitation, Check Point says customers have been attacked, and F5 said exploitation had been observed on the day it disclosed. Patch uptake is a different matter. Hosted VeloCloud Orchestrator was fixed before the listing, on-premises installs were not, and nobody publishes how many Check Point or BIG-IP systems remain unpatched.

Hype gap−8

−100 understated0 aligned+100 overstated

Vendor language runs cooler than the finding

Check Point understates its own result: it names a handful of attacked customers, then concedes that undetected or unreported compromises would raise the figure. CISA's alert, by contrast, is plain: four identifiers and a directive, with no severity language at all. The looseness in the coverage is a citation error, not an exaggeration: SecurityAffairs pins the due date on BOD 22-01 where the agency's alert names BOD 26-04.

Incentives62

0100

Vendors disclosing against themselves

Check Point and F5 both confirmed that their own security appliances were being used against customers. That works against their commercial interest, and it is why the exploitation claims are hard to discount. The agency's interest runs toward listings and deadlines, and its alert reads that way, closing with a pitch for more nominations. SecurityAffairs publishes catalog round-ups steadily; this one is built from the vendor advisories and cites no telemetry of its own.

Confidence72

0100

Details confirmed, scale remains a guess

Dates, identifiers, affected products and fix paths are all attributable, and the two accounts match where they overlap. How far exploitation has spread is one vendor's estimate with a warning attached. The one visible discrepancy sits in the secondary account, which cites the wrong directive for a deadline both accounts otherwise agree on.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

security
CISA updates KEV catalog page to reference new directive BOD 26-04
1 publisher
security
Operators rebuilding CISA's post-CVSS patch sort must merge KEV with Vulnrichment themselves
1 publisher
security
Attackers are running code on BIG-IP APM boxes configured as OAuth authorization servers
5 publishers
security
Check Point patches two 9.8 VPN certificate flaws without naming what triggers them
5 publishers

CISA orders agencies to fix four exploited edge-network flaws by September 25

What happened

Why it matters

What to watch

Claim ledger

Sources

Topics and entities

Topics

Entities

Claim ledger

Sources

Topics and entities

Topics

Entities

Perspective Coverage

Reality

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Perspective Coverage

Reality