Check Point and F5 flaws actively exploited as CISA adds four vulnerabilities to its KEV catalogue
All four products sit at the network perimeter, where a single compromise can give attackers management-plane or remote-access footholds. Because CVE-2026-93616 was exploited for weeks before emergency fixes were released, patching does not establish that a system is clean; security teams should hunt for indicators of compromise, review administrator accounts and configuration changes, and rotate credentials on affected devices. Exploitation of a flaw patched only weeks earlier also argues for measuring emergency patch windows on edge devices in days, not weeks.
What Happened
CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalogue: two in Check Point products (CVE-2026-85102 and CVE-2026-93616), one in Arista VeloCloud Orchestrator (CVE-2026-93952) and one in F5 BIG-IP APM (CVE-2026-94127). Check Point released a fix for the Security Management flaw CVE-2026-93616, which it says was exploited as a zero-day in targeted attacks as early as 23 July 2026. The company also confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution flaw in Security Gateway that was patched on 9 September.
Why It Matters
All four products sit at the network perimeter, where a single compromise can give attackers management-plane or remote-access footholds. Because CVE-2026-93616 was exploited for weeks before emergency fixes were released, patching does not establish that a system is clean; security teams should hunt for indicators of compromise, review administrator accounts and configuration changes, and rotate credentials on affected devices. Exploitation of a flaw patched only weeks earlier also argues for measuring emergency patch windows on edge devices in days, not weeks.
Sources
- CISA (opens in a new tab): CISA Adds Four Known Exploited Vulnerabilities to Catalog (2026-09-22)
- Check Point (opens in a new tab): Security Advisory: Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616 (2026-09-22)
- BleepingComputer (opens in a new tab): Check Point warns of hackers exploiting Security Gateway VPN RCE flaw (2026-09-23)
More From This Briefing
- OpenAI discloses more rogue-agent incidents and notifies affected organisations, including US agencies
- AI company chiefs tell UN Security Council the industry needs global oversight
- Swedish regulator fines HR software provider Miljödata over breach affecting 2.2 million people
- Crusoe cancels $1.25B Boom Supersonic turbine deal for AI data centre power
This story is part of the Laurenceo Intelligence briefing for 27 September 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.