ISCSECURITY — Cyberr
Zane A. — Security Consultant
CISA Orders Federal Agencies to Patch Four Actively Exploited Zero-Days Within 72 Hours
TL;DR: CISA has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, affecting F5 BIG-IP, Arista VeloCloud Orchestrator, and two Check Point platforms. Federal agencies have until September 25 to remediate. The prerequisites matter; not every deployment is in scope, but for those that are, exploitation is already confirmed in the wild.
Why the KEV Catalog Matters:
CISA's KEV catalog is not just guidance; it triggers binding remediation deadlines for US federal agencies and is treated by many private-sector organizations as a de facto priority signal. When a CVE lands in KEV, exploitation is confirmed. These four entries carry a compressed 72-hour deadline because the flaws are unauthenticated, internet-reachable, and already being weaponized.
The Breakdown:
1. The F5 Flaw: CVE-2026-94127
a) Vulnerability Type: Heap-based buffer overflow in BIG-IP Access Policy Manager (APM)
b) Severity: CVSS 9.8
c) Critical Exposure Prerequisite: The vulnerability is only present when BIG-IP APM is explicitly configured as an OAuth Authorization Server with an access policy and OAuth profile active on the same virtual server. Deployments using APM strictly as an OAuth Client or Resource Server are entirely unaffected
d) The Threat: Unauthenticated remote code execution is possible via crafted traffic sent directly to the virtual server. Because the attack targets the data plane rather than the management plane, restricting access to the administrative console offers no protection
e) Detection Indicator: F5 requires forensic triage prior to patching. Look for multiple OAuth authentication failures from a single IP in a short window, followed closely by anomalous commands and a Traffic Management Microkernel (TMM) SIGABRT crash
2. The Arista Flaw: CVE-2026-93952
a) Vulnerability Type: Improper input validation in Arista VeloCloud Orchestrator (VCO) On-Prem
b) Severity: CVSS 10.0 (Maximum Severity)
c) Critical Exposure Prerequisites:
1. The on-premises environment must actively use certificate-based authentication between VeloCloud Edge devices and the Orchestrator
2. The attacker must possess the public key of a valid VeloCloud Edge authentication certificate
3. Network routing access to the VCO web interface is required
d) The Threat: A compromised orchestrator extends the adversary's blast radius to every VeloCloud Edge device it manages, allowing total control over downstream enterprise transit paths
e) Known Threat Intel: Arista has flagged active exploitation emerging from the following malicious IP addresses: 142.93.149.77 and 104.248.126.159
3. The Check Point Edge Flaw: CVE-2026-85102
a) Vulnerability Type: Improper Certificate Validation in the VPN negotiation process
b) Severity: CVSS 9.8
c) Critical Exposure Prerequisite: Affects Security Gateways running or allowing certificate-based authentication for Site-to-Site VPN or Remote Access VPN. Gateways relying strictly on Pre-Shared Keys (PSK) are not vulnerable to this vector
d) The Threat: Allows an unauthenticated remote attacker to completely bypass standard cryptographic validation checks and execute native arbitrary code directly on the Security Gateway, breaking the perimeter boundary
4. The Check Point Management Flaw: CVE-2026-93616
a) Vulnerability Type: Critical Path Traversal affecting Check Point Security Management Server, Multi-Domain Management, Log Server, and SmartEvent platforms
b) Severity: CVSS 9.8
c) Critical Exposure Prerequisite: Relies on network-level access to the Management Plane or SmartEvent APIs. Smart-1 Cloud, standard Firewall Appliances, and Spark Firewalls are not affected
d) The Threat: An unauthenticated attacker can upload and execute malicious web scripts over the network, effectively hijacking the central control plane that dictates an entire enterprise's security policy
Why This Matters:
For Red Teams:
These four flaws represent tier-one initial access vectors. F5 BIG-IP and Arista VCO sit squarely on the perimeter; compromising them yields rapid lateral movement and persistent transit visibility. The F5 OAuth flaw is a masterclass in data-plane targeting, entirely bypassing administrative ACL restrictions.
For Blue Teams:
This is an immediate triage priority. For Arista, check nginx logs for the x-vc-opt HTTP header, audit for unauthorised files at /usr/local/sbin/.vcnode.js, and block the known malicious IPs immediately. For Check Point, CVE-2026-85102 must be patched instantly as it entirely circumvents perimeter gateway authentication.
For Developers and Architects:
The F5 flaw corrupts the exact identity provider (IdP) layer your corporate applications trust. If your SSO setup routes through a vulnerable Authorization Server deployment, every downstream federated application faces immediate session risks. The Check Point Management flaw means your central security policy plane could be manipulated, allowing attackers to alter firewall rules, disable logging, and establish persistent backdoors.
For Decision Makers:
If any of these four products sit in your externally-facing estate, treat this as a P1 incident. The prerequisites matter and reduce the blast radius for some organizations, but for those in scope, the exploitation window is already open. Confirm patch status and IOCs today, not Monday.
Quick Reference: Affected Products and Actions
F5 BIG-IP APM (CVE-2026-94127)
Condition: APM must act as an OAuth Authorization Server
Action: Apply F5's temporary mitigation iRule to isolate the vector for triage, then deploy the official engineering hotfix. Review logs for OAuth failures followed by TMM SIGABRT crashes
Arista VeloCloud Orchestrator On-Prem (CVE-2026-93952)
Condition: Certificate-based edge authentication active
Action: Upgrade immediately to a remediated release (5.2.3.16+ or 6.4.2.8+). Tightly restrict the VCO web interface to trusted administrative network segments. Block the known malicious IPs
Check Point Gateways (CVE-2026-85102)
Condition: VPN architecture utilizing certificate-based authentication
Action: Prioritise immediately. Apply LivePatch Take 24 or the relevant Jumbo Hotfix Accumulator version for your specific software branch
Check Point Management (CVE-2026-93616)
Condition: Network access available to Management or SmartEvent API ports
Action: Restrict Management Server access to tightly trusted, localised IP addresses. Audit directories for rogue script uploads or unrecognised configuration modifications
I hope you find this information useful; have an awesome weekend.
N.B. If interested, join https://cyberr.ai/groups/iscsecurity where discussions can be held or simply getting to know one another 😊
ISCSECURITY Master Class Series: https://iscsecurity.org
Instagram: https://www.instagram.com/iscsecurity73/
GitHub: https://github.com/zanderson73/
#cybersecurity #CISA #zeroDay #F5 #Arista #CheckPoint #redteam #blueteam #infosec #vulnerabilitymanagement #KEV
5 reactions · 0 comments
Topics: #blueteam, #infosec, #vulnerabilitymanagement, #f5, #redteam, #zeroday, #cybersecurity, #checkpoint, #kev, #arista