Check Point VPN Flaws Added to CISA KEV, Now Exploited

Check Point VPN flaws exploited without a login

The headline this week is that attackers are gaining remote access to Check Point deployments without any login at all. Cyber Security News reports active exploitation of CVE-2026-85102, an improper certificate validation flaw in multiple Check Point products carrying a CVSS score of 9.8.

CISA backed that up by adding two Check Point bugs to the Known Exploited Vulnerabilities catalog on 2026-09-22: CVE-2026-85102 and CVE-2026-93616, a path traversal issue also rated 9.8. Neither is currently tagged as ransomware-linked, but a KEV listing means confirmed in-the-wild use. That is the line between patch eventually and patch now. If you run Check Point gateways or management, treat these as this-week work.

More edge devices added to KEV: Arista and F5

Check Point was not alone. The same 2026-09-22 KEV batch added CVE-2026-93952, an improper input validation flaw in Arista VeloCloud Orchestrator with a maximum CVSS of 10, and CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP APM rated 9.8.

BleepingComputer confirms the F5 issue is a zero-day already exploited in remote code execution attacks. All four of these are internet-facing infrastructure that sits in front of your users and workloads, which is exactly what makes them attractive. Inventory your exposure to VeloCloud Orchestrator and BIG-IP APM alongside Check Point and get vendor fixes applied.

The hot exploited list stays crowded

Beyond the fresh KEV adds, several older exploited CVEs remain high-priority movers, all of them KEV-listed and ransomware-linked. JetBrains TeamCity deserialization CVE-2026-63077 (CVSS 9.8, EPSS 0.87) tops the list, followed by SonicWall SMA1000 SSRF CVE-2026-15409 (CVSS 10) and WebPros cPanel and WHM missing authentication CVE-2026-41940 (EPSS 0.99). Oracle PeopleSoft CVE-2026-35273 and Palo Alto PAN-OS authentication bypass CVE-2026-0257 round out the top five.

If any of these products live in your estate and you have not patched, they are the ones being weaponized right now.

What the press adds this week

SecurityWeek and Cyber Security News both cover critical SolarWinds Observability Self-Hosted RCE flaws, CVE-2026-28324 and CVE-2026-28325, now patched. SecurityWeek also reports a critical WordPress vulnerability, CVE-2026-87902, exploited immediately after disclosure, and Cyber Security News flags a Roundcube Webmail SQL injection, CVE-2026-48842, exploited in the wild.

On the Microsoft side, BleepingComputer notes Windows 11 update KB5124010 shipped with 46 changes, and that Microsoft fixed a File History backup feature broken by the September updates. A phishing kit that abuses the Microsoft login flow is also making rounds, which is worth flagging to your identity team.

Do this first

Prioritize by exploitation status, not just CVSS. Start with the confirmed in-the-wild edge devices.

• Patch Check Point (CVE-2026-85102, CVE-2026-93616), Arista VeloCloud Orchestrator (CVE-2026-93952), and F5 BIG-IP APM (CVE-2026-94127) now; all four are new KEV adds.
• Review TeamCity, SonicWall SMA1000, cPanel, PeopleSoft, and PAN-OS for the ransomware-linked KEV flaws above.
• Apply the SolarWinds Observability fixes and check WordPress and Roundcube exposure.
• For your Microsoft estate, the free Senserva Microsoft Patch Tracker ranks open patches by KEV, EPSS, and ransomware linkage so you know which KBs to close first, and the non-Microsoft exploited-CVE tracker follows KEV adds daily.

Sources

• Cyber Security News: Hackers Exploit Critical Check Point VPN Flaws to Gain Remote Access Without Login (2026-09-24)
• BleepingComputer: F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks (2026-09-23)
• SecurityWeek: SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted (2026-09-24)
• Cyber Security News: Critical SolarWinds Flaws Let Attackers Remotely Execute Code on Observability Servers (2026-09-23)
• SecurityWeek: Critical WordPress Vulnerability Exploited Immediately After Disclosure (2026-09-24)
• BleepingComputer: Windows 11 KB5124010 update released with 46 changes and fixes (2026-09-24)
• BleepingComputer: Microsoft fixes bug that broke Windows File History backup feature (2026-09-24)
• Cyber Security News: The Phishing Kit That Turned Microsoft’s Login Flow Into an AI-Powered Fraud Machine (2026-09-23)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-09-24.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.