CISA's KEV Catalog Puts Check Point, Arista and F5 on a Three-Day Clock
CISA's alert names the four entries as CVE-2026-85102, a Check Point improper certificate validation flaw; CVE-2026-93616, a Check Point path traversal flaw; CVE-2026-93952, an Arista VeloCloud Orchestrator improper input validation flaw; and CVE-2026-94127, an F5 BIG-IP APM heap-based buffer overflow. CISA says it added them "based on evidence of active exploitation." KEV exists for exactly this purpose. It tracks bugs attackers are known to be using, which is a different question from how severe a bug looks on paper.
The catalog entries show how tight the deadline is. Each entry has a Date Added of 2026-09-22 and a Due Date of 2026-09-25. Each one also carries a new field: "Forensic triage required per BOD-26-04: Yes." For all four, CISA marks known use in ransomware campaigns as "Unknown."
The required action is the same for all four. Agencies must apply the vendor's mitigations under Binding Operational Directive 26-04 and CISA's separate forensics triage requirements. If no mitigation is available, they must follow BOD 26-04's guidance for cloud services or stop using the product. CISA also makes asset owners responsible for judging whether each device is exposed to the internet.
| CVE | Product | Weakness (CWE) | What an attacker gets, per CISA |
|---|---|---|---|
| CVE-2026-85102 | Check Point Security Gateway, Spark Firewall (site-to-site or remote access VPN) | CWE-295 Improper Certificate Validation | Unauthenticated remote code execution on the gateway |
| CVE-2026-93616 | Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent | CWE-22 Path Traversal | Unauthenticated upload and execution of arbitrary scripts |
| CVE-2026-93952 | Arista VeloCloud Orchestrator (VCO), on-premises | CWE-20 Improper Input Validation | Access to privileged internal functions and impact on the VCO host |
| CVE-2026-94127 | F5 BIG-IP APM with access policy plus OAuth profile | CWE-122 Heap-based Buffer Overflow | Unauthenticated remote code execution |
BOD 26-04 Turns Patching Into Patching Plus Investigation
The alert explains why these four jumped the queue. BOD 26-04, Prioritizing Security Updates Based on Risk, sets vulnerability management rules for Federal Civilian Executive Branch (FCEB) agencies. It tells them to fix KEV-listed CVEs first on publicly exposed assets where exploitation "grant total control of the asset," and lets them put lower-risk work off. All four of today's entries fit that description. Each one is reachable over the network without credentials and ends in code execution or host-level compromise.
The directive has a second half. CISA says BOD 26-04 also sets basic expectations for when agencies must check whether attackers got into a system before it was patched. That is why the forensic triage flag appears on all four entries. Once a flaw is known to be exploited, a clean patch install only tells you the hole is closed now. It says nothing about whether someone came through it earlier.
BOD 26-04 binds only FCEB agencies. CISA still encourages every organization to adopt risk-based vulnerability management and to prioritize KEV entries. For a private-sector team, the useful part is the model: patch internet-facing edge devices within days, then look for signs of an earlier intrusion.
F5 Confirms CVE-2026-94127 Exploitation in BIG-IP APM's OAuth Path
F5 is the vendor with the most detailed public record. Its security advisory K000162605 says that when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE), and adds that "We have learned that this vulnerability has been exploited." The advisory says the vulnerability allows an unauthenticated attacker to perform RCE, the BIG-IP system in Appliance mode is also vulnerable, and it is a data plane issue with no control plane exposure.
That data plane boundary sets the scope. Only BIG-IP systems that handle traffic through a virtual server with both an APM access policy and an OAuth profile attached are exposed. Locking down the management interface does not protect them. SecurityOnline reports that, per F5, the weakness resides inside the Traffic Management Microkernel, the component that processes that traffic. The CVE record, published September 22, scores the flaw 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0.
Version details come from Mallory's threat summary: affected releases include BIG-IP APM 21.1.0, 17.5.x, and 17.1.x versions lacking the applicable engineering hotfixes. F5 notes that software versions which have reached End of Technical Support (EoTS) are not evaluated. If you run older, unsupported BIG-IP builds, you cannot assume they are safe. You simply have no answer from F5.
CISA's catalog entry for this CVE is the only one of the four that tells agencies to mitigate first and patch second. It says to apply F5's iRule as a temporary mitigation so forensic triage can happen, then install the final patch as soon as possible. The Canadian Centre for Cyber Security has also issued advisory AV26-949 concerning actively exploited CVE-2026-94127. For investigators, Mallory's summary says defenders should investigate repeated OAuth failures, suspicious commands, and TMM SIGABRT crashes using F5's compromise guidance, while treating any single indicator as insufficient evidence of compromise. SecurityOnline reports that researchers have not confirmed any public proof-of-concept code yet.
Two Check Point Bugs Hit Both the Gateway and the Console
Check Point has two entries, and they hit different layers of a Check Point deployment. CVE-2026-85102 affects the enforcement layer. CISA's catalog says Check Point Security Gateway and Check Point Spark Firewall using site-to-site VPN or remote access VPN have a certificate validation flaw. It could let an unauthenticated remote attacker run arbitrary code on the gateway. A gateway only has the exposed code path if VPN is in use, so VPN configuration is the first thing to check. CISA's entry points to Check Point support article sk1000117 for the fix. This article does not list per-branch version boundaries for this CVE because we could not confirm them against the CVE record. Check the Jumbo Hotfix take on each gateway against sk1000117.
CVE-2026-93616 affects the management layer. CISA lists Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent. It describes a path traversal flaw that lets an unauthenticated attacker upload and run arbitrary scripts. BleepingComputer reported that Check Point shipped emergency hotfixes and described the flaw as a zero-day used in attacks. It also noted that the Security Management Server stores security policy, processes administrator changes and collects logs across the network. Whoever controls that server can see the firewall estate and potentially change it.
The official CVE record, as captured by the tracker CVETodo, lists these vulnerable Quantum Security Management branches:
The long list of end-of-support branches matters most for organizations that have left management servers alone for years. CISA's entry points to sk1000171 for vendor guidance. The general KEV action covers products with no fix: follow BOD 26-04 cloud guidance or stop using the product. For an old R80.x management server, that means upgrading, replacing or isolating it.
The record also shows how fast things moved. On the morning of September 22, the CVE record carried a CISA SSVC entry (Stakeholder-Specific Vulnerability Categorization, CISA's triage framework) that recorded "no evidence of exploitation," and CVETodo still listed the bug as not in KEV. By the time of the alert, CISA had added it to the catalog with a three-day deadline. If a scanner or tracker pulled data earlier that day, it may still show the old status.
Arista VeloCloud Orchestrator: One Compromised Console, Many SD-WAN Sites
CVE-2026-93952 affects Arista VeloCloud Orchestrator (VCO) on-premises, the console that manages VeloCloud SD-WAN (software-defined wide area network) edge devices. CISA says an improper input validation flaw may let a remote attacker reach privileged internal functions and affect the VCO host. It adds that exploitation "may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator." CISA points administrators to Arista Security Advisory 0183 for fixes.
CISA's description names only the on-premises product. Organizations using an Arista-hosted orchestrator should confirm their deployment type and patch status with Arista. Our inference, based on what an orchestrator does: an attacker who controls it holds a central point that pushes policy and configuration to every connected edge device. That makes post-patch investigation more important here than for a single appliance.
We could not access Arista's advisory directly to confirm its severity scores or its exact list of fixed releases. The Arista-specific remediation details therefore rely on CISA's summary. Administrators should apply the release Advisory 0183 specifies and treat restricting the VCO web interface as a temporary measure while they patch.
What this means for you
If you run any of these four products, patch or mitigate within CISA's three-day window. After that, check whether anyone got in first. If you run none of them, nothing here changes your Windows patch cycle. It is still worth running your asset inventory, because edge appliances often get missed in the monthly Patch Tuesday routine.
In practical order:
The key takeaways:
For federal agencies, this is the first batch of edge-device additions where the patch deadline and the forensic triage requirement are written into every entry, and the September 25 deadline will show how quickly agencies can do both. Private-sector teams are not bound by that date. Their exposure is the same, though: internet-facing VPN gateways, firewall management consoles, SD-WAN orchestrators and BIG-IP access policies. The organizations that patch this week and then check logs from before the patch will be the ones that know whether they were already compromised.