CISA Adds Four Actively Exploited KEVs: Check Point Gateway/Management RCE Flaws, Arista VeloCloud Orchestrator Auth Bypass, F5 BIG-IP APM Heap Overflow

CISA Adds Four Actively Exploited KEVs (TL-2026-2678) is a critical-severity software vulnerability scored CVSS 10, first published 2026-09-26. It has no confirmed attribution, affects Check Point Security Gateway / Spark Firewall (VPN), references 4 CVEs (CVE-2026-85102, CVE-2026-93616, CVE-2026-93952), maps to 12 MITRE ATT&CK techniques (T1036.005, T1059.004, T1090), and is covered by 9 detection rules and 12 indicators of compromise.

Key facts for TL-2026-2678

Threat ID
TL-2026-2678
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-26
Last reviewed
2026-09-26
Attribution confidence
LOW
Motivation
UNKNOWN
Target regions
Global
Detection rules
9
Indicators of compromise
12

CISA added four actively exploited CVEs to its KEV Catalog on 2026-09-22: a Check Point VPN certificate-validation RCE (CVE-2026-85102, exploited since 2026-09-12), a Check Point Management Server pre-auth path traversal enabling script execution (CVE-2026-93616, exploited since 2026-07-23), an Arista VeloCloud Orchestrator unauthenticated input-validation flaw giving control-plane access to SD-WAN management (CVE-2026-93952, CVSS 10.0), and an F5 BIG-IP APM OAuth heap-based buffer overflow chained via a ROP-driven crash-script rewrite to unauthenticated RCE (CVE-2026-94127). BOD 26-04 sets a 2026-09-25 remediation deadline for FCEB agencies.

How CISA Adds Four Actively Exploited KEVs works

On 2026-09-22, CISA added four vulnerabilities across three network/security-appliance vendors to its Known Exploited Vulnerabilities Catalog based on confirmed evidence of active exploitation, triggering a BOD 26-04 remediation deadline of 2026-09-25 for Federal Civilian Executive Branch agencies.

CVE-2026-85102 (CVSS 3.1: 9.8, CWE-295 Improper Certificate Validation) affects Check Point Security Gateway and centrally/locally managed Spark Firewall deployments on the R81/R82 branches. During VPN negotiation, the gateway processes an attacker-supplied certificate before completing authentication; a specially crafted or oversized certificate structure triggers memory corruption leading to remote code execution. Check Point disclosed and patched the flaw on 2026-09-09 (SK1000117); by 2026-09-12 it confirmed a wave of exploitation attempts against Spark Firewall customers worldwide, sourced from anonymization infrastructure (VPN/proxy exit nodes) and using fraudulent client certificates with templated Subject CNs (CN=vpn/vpn-user/vpnuser, OU=users, O=global).

CVE-2026-93616 (CVSS 3.1: 9.8, CWE-22 Path Traversal) is a pre-authentication path traversal and file-upload flaw in the Check Point Management web service (TCP/19009), affecting Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent across R80.x through R82.20. It lets an unauthenticated attacker upload and execute an arbitrary script from an arbitrary path or load an arbitrary Java class. Check Point confirmed the flaw was exploited in a small number of targeted attacks starting 2026-07-23, well before the 2026-09-20 public disclosure; the R82.20 hotfix and updated Jumbo Hotfix Takes (SK1000171) shipped 2026-09-22. Detection artifacts described by Check Point include management-server usernames exceeding 1,000 characters logged to cpm.elg, ReflectionUtils errors referencing '../' traversal sequences, and concurrent FWM/MDS core dumps.

CVE-2026-93952 (CVSS 3.1: 10.0, CVSS 4.0: 9.5, CWE-20 Improper Input Validation) is an unauthenticated flaw in Arista's on-premises VeloCloud Orchestrator (VCO) — versions 5.2.0-5.2.3.15, 6.1.0-6.1.3.7, 6.4.0-6.4.2.7, and 7.0.0-7.0.0.2 — that lets a remote attacker with network access to the VCO web interface reach privileged internal functionality without any tenant or operator credentials, provided the deployment uses certificate-based authentication between VeloCloud Edge devices and the Orchestrator and the attacker holds the public portion of an Edge authentication certificate. Successful exploitation compromises the confidentiality, integrity, and availability of the orchestrator and of every SD-WAN edge device and dataset it manages. Arista's Security Advisory 0183 (2026-09-22) confirms active exploitation and flags connections from 142.93.149.77 and 104.248.126.159 as indicators; fixed builds shipped for the 5.2.x and 6.4.x trains (5.2.3.16+, 6.4.2.8+), with 6.1.x and 7.0.x fixes still pending as of publication. Cloud-hosted/Dedicated VCO deployments were already patched pre-disclosure and are unaffected.

CVE-2026-94127 (CVSS 3.1: 9.8, CVSS 4.0: 9.3, CWE-122 Heap-based Buffer Overflow) affects F5 BIG-IP APM 17.1.x, 17.5.x, and 21.1.0 when a virtual server has both an APM access policy and an OAuth profile configured with APM acting as an OAuth Authorization Server (a non-default, data-plane-only configuration). An unauthenticated attacker sends an oversized Authorization header to the OAuth UserInfo endpoint (/f5-oauth2/v1/userinfo); the handler allocates a fixed 0x4100-byte heap buffer but copies the header value without enforcing that bound, overflowing into adjacent heap memory and corrupting a callback pointer roughly 0x4ff8 bytes into the buffer in the majority of observed executions. Overwriting that pointer enables a stack pivot into an attacker-controlled ROP chain that invokes existing libc functions (open()/write()) to append an attacker command to the crash-handler script /etc/bigstart/scripts/tmm.finish. When the exploit subsequently crashes the TMM process, BIG-IP's own crash-recovery logic invokes 'bash /etc/bigstart/scripts/tmm.finish', executing the attacker's command and completing an unauthenticated-request-to-RCE chain while sidestepping SELinux restrictions on the process that would otherwise constrain it. F5 published hotfixes and an iRule-based interim workaround on 2026-09-22 (K000162605).

Post-exploitation forensic detail for CVE-2026-93952 (tracked internally by Arista as BUG1907167/BUG1937417) is more developed than for the other three CVEs: Arista's advisory and follow-on reporting describe an observed implant left on compromised on-premises VeloCloud Orchestrator hosts consisting of a hidden dropper script at /usr/local/sbin/.vcnode.js, a malicious binary at /usr/local/sbin/vc-sysmond disguised as a legitimate system-monitoring daemon, and a fraudulent systemd unit at /etc/systemd/system/vc-sysmon.service that re-launches the binary on boot/restart for persistence. A file associated with this activity carries the MD5 hash dc78e206eaeadec59fc5801fe4556bd0. Exploitation and follow-on requests were also observed carrying a non-standard HTTP header, x-vc-opt, visible in nginx access logs on compromised VCO hosts alongside encoded-character/unusual-path-component requests and elevated request rates; Arista advises reviewing VCO web access logs, backend application logs, system logs, database logs, and file-system timestamps, and monitoring for unexpected outbound HTTP/HTTPS activity from the VCO host, when investigating suspected compromise.

No vendor or the advisory disclosed actor attribution, named malware family, or a named C2 framework/toolkit for any of the four CVEs; victim identities, victim counts, and affected sectors beyond the general advisories were not released.

MITRE ATT&CK techniques used in TL-2026-2678

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1211 Exploitation for Stealth; T1564.001 Hidden Files and Directories

Execution

T1059.004 Unix Shell

Command and Control

T1090 Proxy

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1505.003 Web Shell; T1543.002 Systemd Service; T1546 Event Triggered Execution

Resource Development

T1583.003 Virtual Private Server; T1587.003 Digital Certificates

Affected products and versions in CISA Adds Four Actively Exploited KEVs

  • Check Point — Security Gateway / Spark Firewall (VPN)
    Vulnerable versions: R81 (EOL); R81.10; R81.20; R82; R82.00.X; R82.10
    Fixed in: Hotfixes per SK1000117, released 2026-09-09
  • Check Point — Security Management Server / Multi-Domain Security Management Server / Log Server / Multi-Domain Log Server / SmartEvent
    Vulnerable versions: R80.x (EOL); R81 (EOL); R81.10; R81.20; R82 (Jumbo Hotfix Take 126 or lower); R82.10 (Jumbo Hotfix Take 44 or lower); R82.20 (pre-hotfix)
    Fixed in: R82.20 Security Hotfix and updated Jumbo Hotfix Takes per SK1000171, released 2026-09-22
  • Arista — VeloCloud Orchestrator (VCO) On-Premises
    Vulnerable versions: 5.2.0-5.2.3.15; 6.1.0-6.1.3.7; 6.4.0-6.4.2.7; 7.0.0-7.0.0.2
    Fixed in: 5.2.3.16 and later; 6.4.2.8 and later (6.1.x and 7.0.x fixes pending as of 2026-09-22)
  • F5 — BIG-IP Access Policy Manager (APM)
    Vulnerable versions: 17.1.0 (prior to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG); 17.5.0 (prior to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG); 21.1.0 (prior to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG)
    Fixed in: Hotfixes per K000162605, released 2026-09-22

Remediation for CISA Adds Four Actively Exploited KEVs

Patches

  • Check Point Security Gateway/Spark Firewall hotfix for CVE-2026-85102 (SK1000117), released 2026-09-09
  • Check Point R82.20 Security Hotfix and updated Jumbo Hotfix Takes for CVE-2026-93616 (SK1000171), released 2026-09-22
  • Arista VeloCloud Orchestrator 5.2.3.16 and 6.4.2.8 for CVE-2026-93952 (6.1.x and 7.0.x train fixes pending as of 2026-09-22)
  • F5 BIG-IP Hotfix-BIGIP-21.1.0.2.0.30.22-ENG / Hotfix-BIGIP-17.5.1.9.0.160.12-ENG / Hotfix-BIGIP-17.1.3.5.0.41.14-ENG for CVE-2026-94127 (K000162605)

Immediate actions

  • Apply Check Point hotfixes for CVE-2026-85102 (SK1000117) and CVE-2026-93616 (SK1000171) immediately on all affected Security Gateway, Spark Firewall, Management Server, and Log Server deployments
  • Update Arista VeloCloud Orchestrator to 5.2.3.16+ or 6.4.2.8+ for CVE-2026-93952; restrict VCO web-interface access to trusted management networks on 6.1.x/7.0.x trains pending a fix
  • Apply the F5 hotfixes referenced in K000162605 for CVE-2026-94127, or deploy F5's interim iRule workaround if patching cannot happen immediately
  • FCEB agencies must remediate all four KEV-listed CVEs by the 2026-09-25 BOD 26-04 deadline; all organizations are encouraged to treat this as their patch SLA

Workarounds

  • Restrict Check Point Management Server (TCP/19009) access to trusted administrative IPs behind a firewall pending patch deployment
  • Monitor and block connections from 142.93.149.77 and 104.248.126.159, the IPs Arista flagged as targeting VeloCloud Orchestrator
  • Apply F5's iRule-based mitigation on any BIG-IP virtual server with an APM access policy plus an OAuth Authorization Server profile configured, if the hotfix cannot be installed immediately
  • Where feasible, temporarily disable certificate-based Mobile Access/VPN authentication on Check Point gateways until CVE-2026-85102 hotfixes are installed
  • On any on-premises VeloCloud Orchestrator with internet-reachable web UI, hunt for the observed CVE-2026-93952 implant: /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond, /etc/systemd/system/vc-sysmon.service, the MD5 dc78e206eaeadec59fc5801fe4556bd0, and the x-vc-opt HTTP header in nginx logs; preserve access/application/system/database logs and file-system timestamps if found

Longer-term hardening

  • Restrict administrative/management interfaces (Check Point management web service TCP/19009, VeloCloud Orchestrator web UI, BIG-IP APM virtual servers) to trusted networks only, never expose them directly to the internet
  • Disable or reconfigure the BIG-IP APM OAuth Authorization Server role on virtual servers where it is not operationally required, to eliminate the CVE-2026-94127 attack surface entirely
  • Harden certificate-based VPN and SD-WAN Edge authentication workflows and add monitoring for anomalous or templated certificate Subject values
  • Adopt a KEV-driven patch SLA modeled on BOD 26-04 for all internet-facing security and network appliances, not just federally mandated assets

CVEs associated with CISA Adds Four Actively Exploited KEVs

CVE-2026-85102, CVE-2026-93616, CVE-2026-93952, CVE-2026-94127

Weaknesses (CWE) in CISA Adds Four Actively Exploited KEVs

CWE-295, CWE-22, CWE-20, CWE-122

Timeline of CISA Adds Four Actively Exploited KEVs

  • Check Point later confirms a small number of targeted attacks exploited the then-undisclosed CVE-2026-93616 Management Server path-traversal flaw starting on this date.
  • Check Point discloses CVE-2026-85102 (VPN certificate-validation RCE) and releases hotfixes via SK1000117; no exploitation observed at time of release.
  • Check Point confirms a wave of exploitation attempts against CVE-2026-85102 targeting Spark Firewall customers worldwide, using fraudulent VPN certificates and anonymization infrastructure.
  • Check Point issues a LivePatch for a separate management-server flaw (CVE-2026-91843) during the same disclosure window.
  • Check Point publicly discloses CVE-2026-93616, the pre-authentication path traversal in its Management web service.
  • F5 publishes advisory K000162605 for CVE-2026-94127, confirming active exploitation of the BIG-IP APM OAuth heap overflow and releasing hotfixes plus an iRule workaround.
  • Arista publishes Security Advisory 0183 for CVE-2026-93952, confirming active exploitation of VeloCloud Orchestrator and naming 142.93.149.77 and 104.248.126.159 as observed source IPs, along with a post-exploitation implant (hidden .vcnode.js dropper, vc-sysmond binary, vc-sysmon.service persistence, MD5 dc78e206eaeadec59fc5801fe4556bd0, and an x-vc-opt HTTP header) found on compromised hosts.
  • Check Point ships the R82.20 Security Hotfix and updated Jumbo Hotfix Takes for CVE-2026-93616 (SK1000171).
  • CISA adds CVE-2026-85102, CVE-2026-93616, CVE-2026-93952, and CVE-2026-94127 to the KEV Catalog citing evidence of active exploitation, setting a BOD 26-04 remediation deadline.
  • Security researchers (Rapid7, Picus Security) publish detailed technical breakdowns of the CVE-2026-94127 exploit chain, including the ROP chain and tmm.finish crash-script hijack mechanism.
  • Arista publishes Revision 1.1 of Security Advisory 0183 for CVE-2026-93952, adding a CSAF machine-readable advisory file.
  • BOD 26-04 remediation deadline for FCEB agencies to patch or discontinue use of all four KEV-listed products.

Sources cited for CISA Adds Four Actively Exploited KEVs

More in vulnerability

Detection coverage for TL-2026-2678

As of 2026-09-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2678 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats