F5, Check Point, and Arista: Four Exploited Vulnerabilities Added to CISA KEV Catalog

CISA has added four flaws affecting F5 BIG-IP APM, Check Point products, and Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog, confirming that they are being actively exploited. The most urgent is CVE-2026-94127, a heap overflow with a CVSS score of 9.8 that enables unauthenticated code execution on BIG-IP APM systems configured as OAuth authorization servers. Check Point has also fixed CVE-2026-85102, a pre-authentication RCE vulnerability in Quantum gateways, and CVE-2026-93616, a path traversal vulnerability in Management Servers observed in attacks since at least July 23. CVE-2026-93952 affects certificate-based VeloCloud Orchestrator configurations, has a maximum severity rating, and has already been used against exposed systems. Organizations must immediately identify affected configurations, install hotfixes and updates, restrict network access, and search for indicators of previous compromise.

Source: Security Affairs