# CISA Adds Four Actively Exploited KEVs: Check Point Gateway/Management RCE Flaws, Arista VeloCloud Orchestrator Auth Bypass, F5 BIG-IP APM Heap Overflow

> CISA added four actively exploited CVEs to its KEV Catalog on 2026-09-22: a Check Point VPN certificate-validation RCE (CVE-2026-85102, exploited since 2026-09-12), a Check Point Management Server pre-auth path traversal enabling script execution (CVE-2026-93616, exploited since 2026-07-23), an Arista VeloCloud Orchestrator unauthenticated input-validation flaw giving control-plane access to SD-WAN management (CVE-2026-93952, CVSS 10.0), and an F5 BIG-IP APM OAuth heap-based buffer overflow chained via a ROP-driven crash-script rewrite to unauthenticated RCE (CVE-2026-94127). BOD 26-04 sets a 2026-09-25 remediation deadline for FCEB agencies.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2678
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-cisa-kev-four-exploited-flaws-tl-2026-2678.webp?v=60d4b25f (Threadlinqs threat intel: CISA KEV four exploited flaws (TL-2026-2678) — Critical severity, 12 IOCs, 9 detection rules.)
- **ID:** TL-2026-2678
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (3 shown free below)
- **CVEs:** CVE-2026-85102, CVE-2026-93616, CVE-2026-93952, CVE-2026-94127

## Description

On 2026-09-22, CISA added four vulnerabilities across three network/security-appliance vendors to its Known Exploited Vulnerabilities Catalog based on confirmed evidence of active exploitation, triggering a BOD 26-04 remediation deadline of 2026-09-25 for Federal Civilian Executive Branch agencies.

CVE-2026-85102 (CVSS 3.1: 9.8, CWE-295 Improper Certificate Validation) affects Check Point Security Gateway and centrally/locally managed Spark Firewall deployments on the R81/R82 branches. During VPN negotiation, the gateway processes an attacker-supplied certificate before completing authentication; a specially crafted or oversized certificate structure triggers memory corruption leading to remote code execution. Check Point disclosed and patched the flaw on 2026-09-09 (SK1000117); by 2026-09-12 it confirmed a wave of exploitation attempts against Spark Firewall customers worldwide, sourced from anonymization infrastructure (VPN/proxy exit nodes) and using fraudulent client certificates with templated Subject CNs (CN=vpn/vpn-user/vpnuser, OU=users, O=global).

CVE-2026-93616 (CVSS 3.1: 9.8, CWE-22 Path Traversal) is a pre-authentication path traversal and file-upload flaw in the Check Point Management web service (TCP/19009), affecting Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent across R80.x through R82.20. It lets an unauthenticated attacker upload and execute an arbitrary script from an arbitrary path or load an arbitrary Java class. Check Point confirmed the flaw was exploited in a small number of targeted attacks starting 2026-07-23, well before the 2026-09-20 public disclosure; the R82.20 hotfix and updated Jumbo Hotfix Takes (SK1000171) shipped 2026-09-22. Detection artifacts described by Check Point include management-server usernames exceeding 1,000 characters logged to cpm.elg, ReflectionUtils errors referencing '../' traversal sequences, and concurrent FWM/MDS core dumps.

CVE-2026-93952 (CVSS 3.1: 10.0, CVSS 4.0: 9.5, CWE-20 Improper Input Validation) is an unauthenticated flaw in Arista's on-premises VeloCloud Orchestrator (VCO) — versions 5.2.0-5.2.3.15, 6.1.0-6.1.3.7, 6.4.0-6.4.2.7, and 7.0.0-7.0.0.2 — that lets a remote attacker with network access to the VCO web interface reach privileged internal functionality without any tenant or operator credentials, provided the deployment uses certificate-based authentication between VeloCloud Edge devices and the Orchestrator and the attacker holds the public portion of an Edge authentication certificate. Successful exploitation compromises the confidentiality, integrity, and availability of the orchestrator and of every SD-WAN edge device and dataset it manages. Arista's Security Advisory 0183 (2026-09-22) confirms active exploitation and flags connections from 142.93.149.77 and 104.248.126.159 as indicators; fixed builds shipped for the 5.2.x and 6.4.x trains (5.2.3.16+, 6.4.2.8+), with 6.1.x and 7.0.x fixes still pending as of publication. Cloud-hosted/Dedicated VCO deployments were already patched pre-disclosure and are unaffected.

CVE-2026-94127 (CVSS 3.1: 9.8, CVSS 4.0: 9.3, CWE-122 Heap-based Buffer Overflow) affects F5 BIG-IP APM 17.1.x, 17.5.x, and 21.1.0 when a virtual server has both an APM access policy and an OAuth profile configured with APM acting as an OAuth Authorization Server (a non-default, data-plane-only configuration). An unauthenticated attacker sends an oversized Authorization header to the OAuth UserInfo endpoint (/f5-oauth2/v1/userinfo); the handler allocates a fixed 0x4100-byte heap buffer but copies the header value without enforcing that bound, overflowing into adjacent heap memory and corrupting a callback pointer roughly 0x4ff8 bytes into the buffer in the majority of observed executions. Overwriting that pointer enables a stack pivot into an attacker-controlled ROP chain that invokes existing libc functions (open()/write()) to append an attacker command to the crash-handler script /etc/bigstart/scripts/tmm.finish. When the exploit subsequently crashes the TMM process, BIG-IP's own crash-recovery logic invokes 'bash /etc/bigstart/scripts/tmm.finish', executing the attacker's command and completing an unauthenticated-request-to-RCE chain while sidestepping SELinux restrictions on the process that would otherwise constrain it. F5 published hotfixes and an iRule-based interim workaround on 2026-09-22 (K000162605).

Post-exploitation forensic detail for CVE-2026-93952 (tracked internally by Arista as BUG1907167/BUG1937417) is more developed than for the other three CVEs: Arista's advisory and follow-on reporting describe an observed implant left on compromised on-premises VeloCloud Orchestrator hosts consisting of a hidden dropper script at /usr/local/sbin/.vcnode.js, a malicious binary at /usr/local/sbin/vc-sysmond disguised as a legitimate system-monitoring daemon, and a fraudulent systemd unit at /etc/systemd/system/vc-sysmon.service that re-launches the binary on boot/restart for persistence. A file associated with this activity carries the MD5 hash dc78e206eaeadec59fc5801fe4556bd0. Exploitation and follow-on requests were also observed carrying a non-standard HTTP header, x-vc-opt, visible in nginx access logs on compromised VCO hosts alongside encoded-character/unusual-path-component requests and elevated request rates; Arista advises reviewing VCO web access logs, backend application logs, system logs, database logs, and file-system timestamps, and monitoring for unexpected outbound HTTP/HTTPS activity from the VCO host, when investigating suspected compromise.

No vendor or the advisory disclosed actor attribution, named malware family, or a named C2 framework/toolkit for any of the four CVEs; victim identities, victim counts, and affected sectors beyond the general advisories were not released.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1587.003 Digital Certificates
- T1583.003 Virtual Private Server
- T1505.003 Web Shell
- T1543.002 Systemd Service
- T1059.004 Unix Shell
- T1211 Exploitation for Stealth
- T1564.001 Hidden Files and Directories
- T1036.005 Match Legitimate Resource Name or Location
- T1546 Event Triggered Execution
- T1090 Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Check Point Management Server Pre-Auth Path Traversal Exploitation (CVE-2026-93616)** (`TL-2026-2678-SPL-001`)

Detects pre-authentication path-traversal exploitation of the Check Point Management web service (TCP/19009) against Security Management Server, Multi-Domain Security Management Server, Log Server, or SmartEvent. Fires on oversized (>1000 char) management-server usernames logged to cpm.elg and on ReflectionUtils errors referencing '../' traversal sequences, the artifacts Check Point confirmed for the targeted exploitation active since 2026-07-23.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1133
- **Data sources:** checkpoint_management_syslog, cpm.elg, network_firewall_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=checkpoint sourcetype="checkpoint:mgmt:cpm_elg" OR sourcetype="syslog"
(dest_port=19009 OR service="19009")
| eval user_len=len(username)
| where user_len>1000 OR match(message, "(?i)ReflectionUtils") OR match(message, "\.\./")
| stats count, values(message) as sample_messages, earliest(_time) as first_seen, latest(_time) as last_seen by src_ip, dest_ip, username
| where count>0
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
// see TL-2026-2678-KQL-001 for the paired KQL exploitation detection (Arista VeloCloud Orchestrator)
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 19009
| where Message has "ReflectionUtils" or Message has "../" or (isnotempty(SourceUserName) and strlen(SourceUserName) > 1000)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, SourceUserName, Message
| summarize count(), make_set(Message) by SourceIP, DestinationIP
```

### Sigma

```yaml
title: Check Point Management Server Path Traversal Artifacts (CVE-2026-93616)
id: 7c3a1e2a-4b3d-4f7e-9a1c-1e2b3c4d5e01
status: experimental
description: Detects cpm.elg artifacts of pre-authentication path traversal against the Check Point Management web service (TCP/19009) - oversized usernames and ReflectionUtils traversal errors.
references:
  - https://support.checkpoint.com/results/sk/sk1000171
  - https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog
author: Threadlinqs Team
date: 2026-09-26
tags:
  - attack.initial-access
  - attack.t1190
  - attack.t1133
  - cve.2026.93616
logsource:
  category: application
  product: checkpoint
  service: cpm
detection:
  selection_port:
    DestinationPort: 19009
  selection_artifact:
    Message|contains:
      - 'ReflectionUtils'
      - '../'
  condition: selection_port and selection_artifact
falsepositives:
  - Legitimate administrator troubleshooting generating verbose ReflectionUtils debug logs (rare, verify against known admin change windows)
level: critical
```

**Known false positives:**

- Legitimate administrators generating verbose ReflectionUtils debug output during authorized management-server troubleshooting

**Tuning notes:** Confirm the management interface is internet-reachable before alerting at critical; if TCP/19009 is already restricted to a trusted management VLAN, downgrade to medium and alert only on external source IPs. Exclude known internal vulnerability-scanner IP ranges.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Arista VeloCloud Orchestrator Unauthenticated Exploitation (CVE-2026-93952) (locked: unlock with TL Creds)
- VeloCloud Orchestrator Post-Exploitation Implant Persistence (CVE-2026-93952) (locked: unlock with TL Creds)
- Anomalous Outbound Traffic from Compromised VeloCloud Orchestrator Host (CVE-2026-93952) (locked: unlock with TL Creds)
- Check Point Fraudulent VPN Certificate Exploitation Attempt (CVE-2026-85102) (locked: unlock with TL Creds)
- Check Point Management Server Post-Traversal Script/Class Execution (CVE-2026-93616) (locked: unlock with TL Creds)
- SD-WAN Edge Certificate Reuse Across Unexpected Orchestrator Sessions (CVE-2026-93952 Lateral Movement) (locked: unlock with TL Creds)
- F5 BIG-IP APM OAuth Heap Overflow to TMM Crash-Script RCE (CVE-2026-94127) (locked: unlock with TL Creds)
- Perimeter Appliance Egress via Anonymization Infrastructure (CVE-2026-85102 Exploitation Wave) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 12)

Defanged, TLP:CLEAR.

- IP address: `142.93.149[.]77`
- File hash: `dc78e206eaeadec59fc5801fe4556bd0`
- IP address: `104.248.126[.]159`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CISA Adds Four Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog)
- [CISA KEV Catalog feed (known_exploited_vulnerabilities.json)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Check Point SK1000117 - CVE-2026-85102 VPN Certificate Validation](https://support.checkpoint.com/results/sk/sk1000117)
- [Check Point SK1000171 - CVE-2026-93616 Management Path Traversal](https://support.checkpoint.com/results/sk/sk1000171)
- [Check Point Security Advisory: Active Exploitation of CVE-2026-85102 and CVE-2026-93616](https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/)
- [Arista Security Advisory 0183 - CVE-2026-93952](https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183)
- [F5 K000162605 - BIG-IP APM vulnerability CVE-2026-94127](https://my.f5.com/manage/s/article/K000162605)
- [NVD - CVE-2026-85102](https://nvd.nist.gov/vuln/detail/CVE-2026-85102)
- [NVD - CVE-2026-93616](https://nvd.nist.gov/vuln/detail/CVE-2026-93616)
- [NVD - CVE-2026-93952](https://nvd.nist.gov/vuln/detail/CVE-2026-93952)
- [NVD - CVE-2026-94127](https://nvd.nist.gov/vuln/detail/CVE-2026-94127)
- [Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks](https://thehackernews.com/2026/09/check-point-warns-of-management-server.html)
- [F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers](https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html)
- [CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM](https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm/)
- [CVE-2026-94127 Explained: F5 BIG-IP APM Heap Overflow Attack](https://www.picussecurity.com/resource/blog/cve-2026-94127-explained-f5-big-ip-apm-heap-overflow-attack)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2678