CISA adds F5 BIG-IP APM and Check Point zero-days to KEV

F5 BIG-IP APM exploited as a zero-day, now in KEV

The most consequential item today is CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP APM carrying a CVSS of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on September 22, and SecurityWeek and Cyber Security News both report it is being exploited as a zero-day to gain remote code execution through the OAuth server component. A KEV listing means this is not a patch-eventually item. Attackers are already using it against internet-facing APM instances, which are exactly the boxes that broker access to your internal apps.

Help Net Security ties the same campaign to Check Point Management Servers and Spark firewalls. Two Check Point flaws landed in KEV the same day: CVE-2026-85102 (improper certificate validation, CVSS 9.8) and CVE-2026-93616 (path traversal, CVSS 9.8). Check Point has published patches for the exploited management server zero-day. If you run either of these products at the edge, treat this as an active incident window, not a maintenance one.

Arista VeloCloud and the rest of the September 22 KEV adds

CISA also added CVE-2026-93952, an improper input validation flaw in Arista VeloCloud Orchestrator with a maximum CVSS of 10. Arista is urging immediate patching and says the VCO zero-day is under active exploitation. VeloCloud Orchestrator manages SD-WAN fabric, so a compromise there reaches far beyond a single appliance.

Rounding out the batch is CVE-2026-7273, the Zyxel GS1900 stack-based buffer overflow, added September 21. We covered it recently, so the takeaway is simply that it is now confirmed on the KEV list alongside the newer edge bugs. None of these five carry a ransomware flag yet, but the exploitation is real and the CVSS scores are severe.

Ransomware-linked movers still worth your attention

Outside the fresh KEV adds, several already-listed CVEs remain hot and are tied to ransomware. CVE-2026-15409 in SonicWall SMA1000 (CVSS 10, EPSS 0.85) and CVE-2026-41940 in WebPros cPanel and WHM (CVSS 9.8, EPSS 0.99) both sit at the top of the exploited list with ransomware linkage. CVE-2026-35273 in Oracle PeopleSoft and CVE-2026-0257 in Palo Alto PAN-OS round out the critical, ransomware-linked, KEV-listed set. If any of these are exposed in your estate and unpatched, they belong ahead of the newer bugs on your queue.

Other patches to schedule this week

WordPress 7.1.2 fixes CVE-2026-87902, a critical unauthenticated path traversal that lets attackers execute code without logging in, per Help Net Security and Cyber Security News. A critical ManageEngine flaw, CVE-2026-74849, allows SYSTEM access through the Windows login screen. SolarWinds patched CVE-2026-28324 and CVE-2026-28325, which permit remote code execution on Observability servers.

On the identity side, Microsoft disrupted the EvilTokens AI-powered phishing service that had given criminals access to roughly 12,000 inboxes by abusing the Microsoft login flow. That is a reminder to review conditional access and token protection, not just patch levels.

Do this first

Work the exploited edge appliances in order of exposure and confirmation of active use.

• Patch F5 BIG-IP APM (CVE-2026-94127), Check Point (CVE-2026-85102, CVE-2026-93616), and Arista VeloCloud Orchestrator (CVE-2026-93952) now, since all are KEV-listed and reported under active exploitation.
• Confirm Zyxel GS1900 (CVE-2026-7273) is patched or removed from internet exposure.
• Update WordPress to 7.1.2 for CVE-2026-87902 and apply the ManageEngine and SolarWinds fixes.
• Check your own patch state against these KEV adds. Senserva's non-Microsoft exploited-CVE tracker follows CISA KEV additions daily, and the free Microsoft Patch Tracker ranks open Microsoft patches by KEV, EPSS, and ransomware linkage.
• Review conditional access and token protection given the EvilTokens disruption, then run a free audit of your Microsoft 365, Intune, Defender, and Entra ID configuration with Senserva.

Sources

• Cyber Security News: Hackers Exploiting F5 BIG-IP OAuth Server 0-day Flaw to Gain Remote Code Execution (2026-09-23)
• SecurityWeek: Critical F5 BIG-IP Vulnerability Exploited as Zero-Day (2026-09-23)
• SecurityWeek: Arista Urges Immediate Patching of Exploited VCO Zero-Day (2026-09-23)
• SecurityWeek: Check Point Patches Exploited Management Server Zero-Day (2026-09-23)
• Help Net Security: Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances (2026-09-23)
• Help Net Security: WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902) (2026-09-23)
• Cyber Security News: Critical ManageEngine Flaw Lets Attackers Gain SYSTEM Access Through Windows Login Screen (2026-09-23)
• Cyber Security News: Critical SolarWinds Flaws Let Attackers Remotely Execute Code on Observability Servers (2026-09-23)
• Help Net Security: Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes (2026-09-23)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-09-23.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.