CYBERSECURITY & PRIVACY · ACTIVE EXPLOITATION · PATCH ALERT
CISA September 25 Patch Deadline: 4 Exploited F5, Check Point and Arista Flaws to Fix Now
CISA’s September 25 deadline covers four actively exploited vulnerabilities in F5 BIG-IP, Check Point and Arista VeloCloud infrastructure. Here is who is exposed, what each vendor confirmed and the remediation sequence defenders should follow today.
Published September 25, 2026 · Defensive security guide · Digital Pulse Brief
Cybersecurity and Infrastructure Security Agency (CISA) logo. U.S. federal government work, public domain. Source file.
Action first: CISA added four actively exploited perimeter vulnerabilities to its Known Exploited Vulnerabilities catalog on September 22, 2026, with a September 25 remediation deadline for U.S. federal civilian agencies. The affected products are F5 BIG-IP APM, two Check Point product families and Arista VeloCloud Orchestrator. Private organizations are not automatically bound by the federal deadline, but active exploitation makes these issues priority-one patching candidates.
The unusual part is not simply that four critical vulnerabilities appeared at once. They sit on network-edge systems that frequently handle authentication, VPN access, orchestration or traffic policy. That gives attackers a path to reach infrastructure before they need a normal user account.
This guide focuses on defensive action: how to tell whether you are exposed, what each vendor has confirmed, and what should happen before a team closes the ticket. It does not reproduce exploit steps or proof-of-concept code.
Four CISA KEV vulnerabilities due September 25
| CVE | Vendor/product | Issue | Severity | Active exploitation |
|---|---|---|---|---|
| CVE-2026-94127 | F5 BIG-IP APM | Heap-based buffer overflow leading to unauthenticated remote code execution in a specific APM/OAuth configuration | Critical; CVSS 3.1 9.8 | Confirmed |
| CVE-2026-85102 | Check Point Security Gateway / Spark Firewall | Improper certificate validation during VPN negotiation can allow unauthenticated remote code execution | Critical; CVSS 3.1 9.8 | Confirmed |
| CVE-2026-93616 | Check Point Security Management | Pre-authentication path traversal can lead to arbitrary script execution / Java class loading | Critical; CVSS 3.1 9.8 | Confirmed |
| CVE-2026-93952 | Arista VeloCloud Orchestrator | Remote access to privileged internal functionality can compromise the orchestrator host and managed data | CVSS 3.1 10.0 / CVSS 4.0 9.5 | Confirmed |
CISA’s KEV catalog is designed to prioritize vulnerabilities with evidence of real-world exploitation, rather than every high CVSS score. CISA’s current risk-based directive also ties urgent remediation to exposure and forensic triage. For non-federal organizations, the practical lesson is the same: internet-facing affected systems should move ahead of normal monthly patch cycles.
What defenders should do today
1. Inventory the edgeIdentify every F5 BIG-IP APM, Check Point gateway/management server and VeloCloud Orchestrator instance, including disaster-recovery and secondary sites.
2. Check configuration, not just product nameF5 exposure depends on APM plus OAuth profile configuration; Check Point and VeloCloud exposure depends on affected release branches and deployment type.
3. Apply vendor fixes or documented mitigationsUse the vendor advisory—not a third-party patch bundle or an unverified workaround.
4. Preserve evidenceBefore wiping logs or rebuilding a suspected host, retain relevant authentication, management, VPN and network telemetry for incident review.
5. Hunt after patchingPatching stops a known route in; it does not prove the device was clean before the fix.
6. Review credentials and trustIf compromise is suspected, follow the vendor/incident-response process for credentials, certificates, tokens and downstream access that may have been exposed.
F5 Tower in Seattle. Photo: Joe Mabel / Wikimedia Commons, CC BY-SA 4.0. Source file.
CVE-2026-94127: F5 BIG-IP APM unauthenticated RCE
F5’s advisory describes CVE-2026-94127 as a heap-based buffer overflow affecting BIG-IP Access Policy Manager when an APM access policy and an OAuth profile are configured on the same virtual server. Under that condition, specially crafted traffic can lead to unauthenticated remote code execution. F5 says Appliance mode is also vulnerable and describes the issue as a data-plane exposure rather than a control-plane flaw.
The affected branches identified in the vendor data include BIG-IP 17.1, 17.5 and 21.1 before the relevant engineering hotfix levels. The safest operational approach is not to translate those ranges from memory: check the exact build on each device against F5 advisory K000162605, then apply F5’s prescribed update or mitigation.
The Canadian Centre for Cyber Security issued its own September 22 alert, also noting active exploitation and the APM/OAuth condition. Its advice emphasizes internet-gateway hardening and timely patching, reinforcing that this is an edge-device incident rather than a routine application-library update.
Exposure question: Do not assume “we run BIG-IP” means every instance is affected—or that “we do not expose the management UI” means you are safe. The vulnerable path is tied to the APM/OAuth data-plane configuration on the virtual server.
What to verify after remediation
- Confirm the running BIG-IP build/hotfix is no longer in the affected range.
- Identify every virtual server using both APM policy and OAuth profile components.
- Review logs and security telemetry covering the period before the fix.
- Escalate unexplained process execution, configuration changes or suspicious authentication activity into incident response rather than closing the ticket as “patched.”
Check Point building: Avi1111 / Wikimedia Commons, CC BY-SA 4.0. Logo sourced from Wikimedia Commons; public-domain copyright status noted for the simple mark. Editorial trademark use only.
Check Point has two separate actively exploited flaws
Check Point’s September 22 security advisory covers two vulnerabilities with different attack surfaces. Treating them as one “VPN bug” risks missing exposed management servers.
CVE-2026-85102: certificate validation during VPN negotiation
CVE-2026-85102 is an improper certificate-validation issue in Quantum Security Gateway that can allow an unauthenticated remote attacker to execute arbitrary code during VPN negotiation. Check Point lists Security Gateway and Spark Firewall deployments among the affected products and assigns a CVSS 3.1 score of 9.8.
Check Point says it began observing a wave of exploitation attempts against Spark customers on September 12. The company published examples of certificate subjects seen in those attacks, but explicitly warns that the list is not exhaustive. That matters operationally: defenders should not write one narrow detection rule and assume every other connection is benign.
CVE-2026-93616: pre-authentication path traversal on management servers
CVE-2026-93616 affects the Check Point management web service. The vendor describes a pre-authentication path traversal that can lead to arbitrary-path script execution and Java class loading. Check Point says it observed a small number of targeted attacks beginning on July 23, 2026.
The management-server flaw affects multiple R82/R81 release and Jumbo Hotfix levels, including end-of-support branches. Check Point also warns that earlier LivePatch takes referenced in its advisory do not address this issue. Administrators should therefore use sk1000171 to validate the exact fix state rather than assuming “LivePatch enabled” equals protected.
For the gateway issue, use sk1000117. Check Point’s consolidated active-exploitation advisory provides the current high-level description, observed attack timing and links to both remediation documents.
Operational mistake to avoid: patching only internet-facing gateways while leaving the management plane on a vulnerable build. These are two distinct CVEs and should be tracked as separate remediation and hunting tasks.
Arista switch: Premeditated / Wikimedia Commons, CC BY-SA 4.0. Arista Networks logo sourced from Wikimedia Commons with public-domain copyright status for the simple text/geometric mark; editorial trademark use only.
CVE-2026-93952: Arista VeloCloud Orchestrator reaches CVSS 10.0
Arista’s Security Advisory 0183 covers CVE-2026-93952 in VeloCloud Orchestrator. The company says a remote attacker may be able to reach privileged internal functionality and affect the VCO host, with potential impact to the confidentiality, integrity and availability of the orchestrator and its managed data.
The advisory gives the issue a CVSS 3.1 base score of 10.0 and CVSS 4.0 score of 9.5. Arista confirms that the vulnerability is known to be actively exploited.
The deployment distinction is important. Arista says hosted—including Dedicated—VCO environments were affected but have already been patched by the provider. On-premises customers must compare their deployment against the affected release lines in Security Advisory 0183 and apply the prescribed update.
That means a managed/cloud customer and an on-prem customer can have very different remediation responsibilities even though both use “VeloCloud Orchestrator.” Asset records should capture the operating model, not just the product family.
Why this four-CVE cluster deserves more attention than a normal patch alert
All four vulnerabilities sit close to the perimeter or management layer. These systems often mediate identity, remote access, network policy or orchestration. A compromise can therefore be more consequential than a flaw in an isolated desktop application because the device itself may be trusted by other systems.
The common lesson is not “CVSS 10 means panic.” It is that active exploitation + reachable edge infrastructure + privileged function is a dangerous combination. CISA’s KEV process is valuable precisely because it adds exploitation evidence to the severity conversation.
Digital Pulse Brief recently covered how Microsoft disrupted EvilTokens device-code phishing and how researchers used Claude during an OpenAI bug-bounty engagement. Those incidents are different technically, but they underline the same operational point: identity and perimeter controls are becoming high-leverage targets, and defenders need evidence-driven prioritization rather than a backlog sorted only by CVSS.
A practical September 25 remediation checklist
- Confirm ownership: assign a named owner for every affected appliance, orchestrator and management server.
- Verify exposure: map internet-facing interfaces, remote-access paths, APM/OAuth configuration, Check Point product/build levels and VCO deployment type.
- Read the vendor advisory before changing production: confirm the exact fixed build or vendor mitigation for the installed branch.
- Back up configuration appropriately: preserve what is required for recovery without overwriting forensic evidence on a suspicious system.
- Patch or mitigate: prioritize internet-facing and externally reachable instances first.
- Validate the fix: confirm the running version/build and affected feature state after restart or failover.
- Review historical logs: look back to at least the vendor-reported exploitation windows where logs are available.
- Escalate anomalies: unexplained admin changes, new accounts, unfamiliar processes, certificate anomalies or unexpected outbound connections should trigger incident-response procedures.
- Reassess trust if compromise is suspected: credentials, API tokens, certificates and sessions reachable through the device may need vendor-guided rotation or revocation.
- Document completion: record affected asset, previous build, fixed build, timestamp, evidence reviewed and any remaining exception.
Does the September 25 deadline apply to every company?
No. The CISA due date is a binding operational requirement for covered U.S. federal civilian executive branch agencies under CISA directives. A private company in the US, Europe, Asia or elsewhere is not automatically subject to the same federal deadline simply because a CVE is in KEV.
But KEV inclusion is still globally relevant threat intelligence. It means exploitation has moved beyond theoretical severity. For internet-facing enterprise infrastructure, waiting for a normal monthly maintenance window can be difficult to justify when the vendor and CISA both confirm real-world attacks.
FAQ
Which four vulnerabilities have the September 25 CISA deadline?
CVE-2026-94127 in F5 BIG-IP APM, CVE-2026-85102 and CVE-2026-93616 in Check Point products, and CVE-2026-93952 in Arista VeloCloud Orchestrator.
Are all four vulnerabilities being exploited?
Yes. Vendor advisories and KEV data identify active exploitation for all four.
Is CVE-2026-94127 remotely exploitable without authentication?
Under the affected BIG-IP APM configuration, F5 says the flaw can permit unauthenticated remote code execution. Exposure depends on the specific APM access-policy and OAuth-profile configuration described in the vendor advisory.
Does patching prove the device was not compromised?
No. Patching removes or mitigates the vulnerability, but a system exploited before remediation can still contain persistence, altered configuration or stolen credentials. That is why log review and incident triage belong in the same workflow.
Are Arista-hosted VeloCloud Orchestrators still waiting for customers to patch?
Arista says hosted, including Dedicated, VCO versions that were affected have already been patched. On-premises customers should review Security Advisory 0183 for their own release and remediation path.
Methodology and source discipline
This article was researched on September 25, 2026 using vendor security advisories, CISA KEV information and government cybersecurity guidance. It is a defensive remediation guide, not an exploit tutorial. Digital Pulse Brief has not independently reproduced any of the vulnerabilities or tested vendor patches in a lab.
Primary sources
- CISA — Known Exploited Vulnerabilities Catalog
- CISA — BOD 26-04 risk-based remediation guidance
- F5 — K000162605: BIG-IP APM vulnerability CVE-2026-94127
- Check Point — active exploitation advisory for CVE-2026-85102 and CVE-2026-93616
- Arista — Security Advisory 0183 for CVE-2026-93952
- Canadian Centre for Cyber Security — F5 BIG-IP APM alert
You may also like
Visual-use record: the CISA logo is a U.S. federal government public-domain work. F5 Tower, the Check Point building and the Arista switch photographs are CC BY-SA 4.0 with attribution preserved. Check Point and Arista logos are simple text/geometric marks identified by Wikimedia Commons as public domain for copyright purposes; trademark rights remain with their owners and use here is editorial.
MORE FROM DIGITAL PULSE BRIEF
