CISA's September 22 KEV Additions: What the Check Point, Arista, and F5 Flaws Mean for Your Perimeter
By Chuck Lerch, Founder and CEO, Cyberuptive
On September 22, 2026, the Cybersecurity and Infrastructure Security Agency added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog in a single day: two in Check Point Quantum gateways and management servers, one in Arista's VeloCloud Orchestrator, and one in F5 BIG-IP APM. All four are unauthenticated, remotely reachable, and confirmed exploited in the wild by their own vendors. CISA set a September 25 remediation deadline — a 72-hour window. If your organization or your MSSP runs any of these products at the network edge, this is not a monthly patch-cycle item.
CISA rarely adds four vendor-confirmed, actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in a single day. On September 22, 2026, it did exactly that, listing CVE-2026-85102 and CVE-2026-93616 in Check Point Quantum products, CVE-2026-93952 in Arista's VeloCloud Orchestrator, and CVE-2026-94127 in F5 BIG-IP APM — each with a remediation due date of September 25, 2026 (CISA KEV catalog). That three-day deadline is a compliance requirement only for federal civilian executive branch agencies under Binding Operational Directive 26-04, but it is a reasonable urgency benchmark for anyone else: KEV listing means CISA has evidence of real-world exploitation, not theoretical risk.
Why four unrelated products landed on the same list
Check Point Quantum Security Gateways, Arista's VeloCloud Orchestrator, and F5 BIG-IP APM have nothing in common architecturally, but they occupy the same role in a network: they sit at the perimeter, they terminate or broker authenticated sessions, and they are reachable from the internet by design. That combination — internet-facing plus authentication-adjacent — is exactly the profile attackers have prioritized against remote-access gateways all year, a pattern we've tracked across Citrix NetScaler, Palo Alto GlobalProtect, and SonicWall SMA1000. Four vendors, same target profile, same week — that concentration is itself a signal that adversaries are actively probing perimeter appliances across the board, not just picking on one vendor's bad quarter.
The four vulnerabilities, in detail
CVE-2026-85102: Check Point VPN certificate validation bypass
CVSS 9.8 (Critical). An improper certificate-validation flaw during VPN negotiation on Check Point Quantum Security Gateways and Spark Firewalls lets an unauthenticated remote attacker execute arbitrary code on the gateway (Check Point advisory sk1000117). It affects gateways using certificate-based authentication for site-to-site or remote-access VPN; gateways relying solely on pre-shared keys are not vulnerable. Check Point's own advisory confirms active exploitation against Spark Firewalls specifically, dating the observed activity to September 12, 2026 — ten days before the KEV listing.
CVE-2026-93616: Check Point management server path traversal
CVSS 9.8 (Critical). A directory-traversal and file-upload flaw lets an unauthenticated attacker upload and execute arbitrary scripts on Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, or SmartEvent (Check Point advisory sk1000171). This one is more consequential than the gateway bug in some ways: a compromised management server can rewrite policy across every gateway it manages. Check Point's advisory states plainly that the vulnerability "is exploited in the Wild" and that the company "is aware of a handful of customers who have been attacked."
CVE-2026-93952: Arista VeloCloud Orchestrator input validation
CVSS 9.5 (Critical, CVSS 4.0). An improper input-validation flaw in on-premises deployments of Arista's VeloCloud Orchestrator (VCO) — the management console for VeloCloud SD-WAN edge devices — can let a remote attacker reach privileged internal functionality on the orchestrator host, threatening the confidentiality, integrity, and availability of every edge device it manages (Arista Security Advisory 0183; NVD entry). Arista's hosted and dedicated cloud versions of VCO were also affected but have already been patched by the vendor; exposure is now specific to self-managed, on-premises orchestrators.
CVE-2026-94127: F5 BIG-IP APM heap overflow
CVSS 9.3 (Critical, CVSS 4.0). A heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM) allows unauthenticated remote code execution when a virtual server has both an APM access policy and an OAuth profile configured (F5 advisory K000162605). F5 states directly: "we have learned that this vulnerability has been exploited." Deployments using APM strictly as an OAuth client or resource server — without an OAuth authorization server profile — are not affected. The Canadian Centre for Cyber Security separately issued advisory AV26-949 on the same flaw, an unusual degree of multi-agency attention for a single CVE.
Detection: what to actually look for
Vendor guidance for these four flaws goes beyond "patch it" — both Check Point and F5 published concrete investigation steps, which is worth taking seriously given confirmed exploitation.
- Check Point management servers (CVE-2026-93616): from Expert mode, search
cpm.elg*logs for oversized username fields in login attempts alongside a concurrent FWM/MDS core dump, and separately search forReflectionUtilserrors referencingallResourceFilesthat contain path-traversal sequences such as../../../../— both are documented exploitation signatures in Check Point's own advisory (sk1000171). - Check Point gateways (CVE-2026-85102): confirm whether each gateway uses certificate-based site-to-site or remote-access VPN — that configuration is the exposed path. Pre-shared-key-only gateways are not affected.
- F5 BIG-IP APM (CVE-2026-94127): look for repeated OAuth authentication failures and TMM
SIGABRTcrashes on virtual servers running APM with an OAuth profile. F5 is explicit that no single indicator alone confirms compromise — correlate multiple signals before concluding an exploit succeeded. - Arista VCO (CVE-2026-93952): Arista has not published specific IOCs; treat any unexpected administrative activity or configuration drift on an on-premises orchestrator as suspect until the patch is confirmed installed, since a compromised orchestrator can affect every SD-WAN edge device it manages.
Remediation, in priority order
- Patch the management-plane flaws first. CVE-2026-93616 (Check Point management server) and CVE-2026-93952 (Arista VCO) compromise infrastructure that controls other devices — a breach there has blast radius beyond the single box.
- Check Point: install the Jumbo Hotfix Accumulator level specified in sk1000117 (gateways) and sk1000171 (management servers). Note that a LivePatch is not available for the management-server flaw because of how the fix works — a full hotfix accumulator install is required.
- Arista: apply the fix in Security Advisory 0183 for on-premises VCO deployments. As an interim measure while patching, restrict access to the VCO web interface to trusted management networks.
- F5: install the engineering hotfix for your branch (21.1.0, 17.5.x, or 17.1.x) per K000162605. If immediate patching isn't possible, contact F5 Support for the mitigating iRule to apply to the affected virtual server as a stopgap.
- Assume compromise on unpatched, internet-facing appliances until proven otherwise. Preserve pre- and post-patch logs, check for new administrator accounts and unauthorized policy changes on management consoles, and rotate credentials, certificates, and keys stored on any device that shows suspicious activity. A clean patch closes the vulnerability — it does not retroactively rule out an earlier intrusion.
Organizations that outsource perimeter management should confirm their provider treats KEV-listed CVEs on VPN gateways, SD-WAN orchestrators, and load balancers as same-day priorities rather than folding them into a monthly patch cycle. That posture is the operating model behind Cyberuptive's patch management and vulnerability scanning services, and it is what our managed firewall customers get on edge appliances generally. Detection engineering for exploitation attempts against exactly this class of device — VPN gateways, management consoles, SD-WAN orchestrators — is core to the managed detection and response function a 24/7 SOC provides; a patch cycle alone does not catch an attacker who got in before the fix shipped.
Timeline
- September 7, 2026: Check Point publishes advisory sk1000117 for CVE-2026-85102.
- September 12, 2026: Check Point confirms active exploitation of CVE-2026-85102 against Spark Firewalls.
- September 20, 2026: Check Point publishes advisory sk1000171 for CVE-2026-93616, confirming exploitation against management servers.
- September 22, 2026: CISA adds all four CVEs — CVE-2026-85102, CVE-2026-93616, CVE-2026-93952, and CVE-2026-94127 — to the KEV catalog with a September 25 remediation deadline; F5 publishes advisory K000162605 the same day.
- September 25, 2026: CISA's remediation deadline for federal civilian executive branch agencies.
Frequently asked questions about the Check Point, Arista, and F5 KEV additions
What did CISA add to its KEV catalog on September 22, 2026?
Four critical vulnerabilities: CVE-2026-85102 and CVE-2026-93616 in Check Point Quantum gateways and management servers, CVE-2026-93952 in Arista's VeloCloud Orchestrator, and CVE-2026-94127 in F5 BIG-IP APM. All four are unauthenticated, remotely exploitable, and confirmed by their vendors as actively exploited (CISA KEV catalog).
Does the September 25, 2026 deadline apply to my organization?
The binding deadline under Binding Operational Directive 26-04 applies only to federal civilian executive branch agencies. Everyone else should still treat it as an urgency signal: CISA only lists a CVE in the KEV catalog when it has evidence of real-world exploitation, not theoretical risk.
Which of the four vulnerabilities should we prioritize if we run more than one affected product?
Prioritize the management-plane flaws first — CVE-2026-93616 (Check Point management server) and CVE-2026-93952 (Arista VCO) — because compromising the console that manages other devices has a larger blast radius than compromising a single gateway or load balancer.
Can I fix the Check Point management server flaw with a LivePatch instead of a full hotfix install?
No. Check Point's advisory sk1000171 states that a LivePatch is not available for CVE-2026-93616 because of how the fix works — you need to install the Jumbo Hotfix Accumulator level specified for your branch (sk1000171).
Is there a temporary workaround for the F5 BIG-IP APM flaw if we can't patch immediately?
F5 offers a mitigating iRule that can be applied to the affected virtual server as a stopgap; contact F5 Support to obtain it. It is not a substitute for installing the engineering hotfix, only a way to reduce risk during the patch window.
How do I know if my Check Point gateway is actually exposed to CVE-2026-85102?
Only gateways using certificate-based authentication for site-to-site or remote-access VPN are affected. Gateways in encryption communities authenticated solely by pre-shared key are not vulnerable to this specific flaw.
If an MSSP manages our firewall, VPN gateway, or SD-WAN, whose job is it to catch this?
That depends entirely on the contract's scope. "We manage your firewall" and "we treat KEV-listed CVEs on your perimeter appliances as same-day priorities" are two different commitments. Ask your provider whether patch validation for these four specific CVEs has already happened, and ask for evidence rather than a status update.