Check Point Management Zero-Day, F5 BIG-IP APM Heap Overflow, and Arista VeloCloud CVSS 10.0 Land in CISA KEV; WordPress 7.1.2 Path Traversal Under Active Attack

Posted on by

This brief covers the trailing ~48 hours (September 22–23, 2026). Every item below was checked against its primary source — the vendor advisory, CISA’s Known Exploited Vulnerabilities (KEV) catalog, or the original research post — and the dates and scores shown are the ones published there.

CISA adds four zero-days to KEV in one day: Check Point (×2), F5 BIG-IP APM, Arista VeloCloud

CISA · September 22, 2026

CISA added four vulnerabilities to the KEV catalog on September 22, all of them edge or management-plane products and all with a federal remediation deadline of September 25, 2026: CVE-2026-85102 and CVE-2026-93616 (Check Point), CVE-2026-93952 (Arista VeloCloud Orchestrator), and CVE-2026-94127 (F5 BIG-IP APM). Each is covered in its own item below. A day earlier, on September 21, CISA also added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switches, with a September 24 deadline.

“These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.” — CISA

Source: CISA alert (Sept 22) · CISA alert (Sept 21, Zyxel)

Check Point discloses exploited Security Management zero-day (CVE-2026-93616) and confirms in-the-wild attacks on the VPN certificate flaw (CVE-2026-85102)

Check Point · September 22, 2026

Check Point published sk1000171 and a security blog for CVE-2026-93616 (CVSS 9.8), a pre-authentication directory traversal and file upload bug in the Security Management Server, Multi-Domain Server, Log Server, and SmartEvent that lets an attacker with access to the management web service (TCP/19009) run arbitrary scripts. The company says it was used in a handful of targeted attacks on July 23, 2026. Affected: R82.20, R82.10 JHF Take 44 and below, R82 Take 126 and below, R81.20 Take 166 and below, and end-of-support R81.10 and earlier; fixes are R82.10 Take 45+, R82 Take 127+, R81.20 Take 170+, R81.10 Take 192+, and a hotfix for R82.20. There is no LivePatch for this one. The same advisory reports that CVE-2026-85102 (CVSS 9.8, the improper certificate validation flaw patched September 9) is now seeing exploitation attempts against Spark firewall customers globally, starting around September 12. Both CVEs were added to CISA KEV on September 22.

“CVE-2026-93616 is a newly discovered zero-day vulnerability in Security Management, and a fix is available now as part of this advisory.” — Lotem Finkelstein, Check Point

Source: Check Point sk1000171 · Check Point blog · BleepingComputer

F5 patches BIG-IP APM heap overflow exploited for unauthenticated RCE on OAuth authorization servers (CVE-2026-94127)

F5 · September 22, 2026

F5 advisory K000162605 describes CVE-2026-94127, a heap-based buffer overflow (CWE-122) in BIG-IP Access Policy Manager rated 9.8 on CVSS v3.1 and 9.3 on CVSS v4.0. It is reachable only when an APM access policy and OAuth profile are attached to a virtual server with APM acting as an OAuth Authorization Server; client- and resource-server-only deployments are not affected. F5 says the bug has been exploited and shipped engineering hotfixes for 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3, with an iRule mitigation available from F5 Support. Other BIG-IP modules, BIG-IP Next, F5OS, NGINX, and Distributed Cloud are not vulnerable. Added to CISA KEV September 22.

“This vulnerability allows an unauthenticated attacker to perform RCE.” — F5, K000162605

Source: F5 K000162605 · BleepingComputer

Arista VeloCloud Orchestrator CVSS 10.0 input-validation flaw actively exploited (CVE-2026-93952)

Arista · September 22, 2026

Arista Security Advisory 0183 covers CVE-2026-93952, an improper input validation bug in on-premises VeloCloud Orchestrator rated 10.0 on CVSS v3.1 (9.5 on v4.0). It affects deployments that use certificate-based Edge-to-Orchestrator authentication; an attacker with network access to the VCO web UI and the public portion of an Edge authentication certificate can reach privileged internal functions without tenant or operator credentials. Affected: 5.2.3.15 and below, 6.1.3.7 and below, 6.4.2.7 and below, and 7.0.0.2 and below. Fixes are available for 5.2.3.16+ and 6.4.2.8+; Arista says patches for the 6.1.x and 7.0.x lines are still pending, and hosted VCO instances have already been patched. The advisory lists file, service, and IP indicators of compromise. Added to CISA KEV September 22.

“This issue was discovered externally and is known to be actively exploited.” — Arista Security Advisory 0183

Source: Arista SA 0183 · BleepingComputer

WordPress 7.1.2 fixes unauthenticated path traversal (CVE-2026-87902); exploitation began within hours

WordPress.org / Patchstack · September 22–23, 2026

WordPress 7.1.2 shipped on September 22 to fix CVE-2026-87902, an unauthenticated path traversal in page template resolution that yields local file inclusion and, on servers with a writable include path or PEAR’s pearcmd available, code execution. WordPress rates it 9.2 on CVSS v4.0 (8.1 on v3.1); it affects every core release from 4.7.0 through 7.1.1, with backports down to 4.7.37. A proof of concept from the reporter is public. Patchstack observed reconnaissance traffic less than five hours after the release and, by September 23, attackers writing PHP files to disk via the flaw. Not in CISA KEV at time of writing.

“That is arbitrary file write with attacker-controlled PHP content, which is code execution.” — Patchstack

Source: WordPress 7.1.2 release · Patchstack · BleepingComputer

Next.js 16.3.6 patches critical RCE in next/og ImageResponse (CVE-2026-94545)

Vercel · September 22, 2026

Vercel published GHSA-vcvr-r3jv-pc5j for CVE-2026-94545, rated Critical (CVSS v4.0 9.5), in the Node.js implementation of ImageResponse from next/og. Improper escaping in SVG output generated by the upstream Satori library can lead to remote code execution when attacker-controlled values land in SVG content, attributes, or styles. Affected: Next.js 16.2.0 through 16.3.5; fixed in 16.3.6 (15.5.26 adds hardening, and the Edge runtime implementation is not affected). No exploitation has been reported and the flaw is not in KEV.

Source: GHSA-vcvr-r3jv-pc5j · Next.js blog · The Hacker News

Public exploit for unpatched Ubuntu kernel AF_UNIX use-after-free enables container-to-host root (CVE-2026-80521)

DepthFirst · September 22, 2026

DepthFirst researcher Zhenpeng Lin published a working container escape exploit for CVE-2026-80521 (CVSS 7.8), a use-after-free in the Linux kernel’s AF_UNIX socket garbage collector introduced in 6.10 and backported to 6.1 and 6.6. Upstream fixed it on August 6 (mainline 7.2, stable 7.1.10), but Ubuntu’s tracker still lists the kernel packages for 26.04 and 24.04 as “Vulnerable, work in progress.” The exploit code is public on GitHub. No in-the-wild exploitation has been reported and the CVE is not in KEV.

“As of today, it is still unpatched in the latest ubuntu 26.04 release.” — DepthFirst

Source: DepthFirst research · The Hacker News

Financially motivated actor uses open-source AI agent frameworks to skim 600,000+ payment cards

Gambit Security · September 22, 2026

Gambit Security’s threat intelligence team documented an ongoing campaign, active since at least July, in which a threat actor runs open-source agent frameworks (Strix, Cairn, Hermes) to attack online retailers autonomously at roughly $25 per target. The report counts more than 600,000 unexpired card records taken from two victims, skimmers on at least 119 sites, and 105 attack projects against 27+ companies in the September 10–15 window alone. No CVE is involved; the agents chain ordinary web application weaknesses.

“Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees.” — Gambit Security

Source: Gambit Security · BleepingComputer

ShinyHunters claims FBI breach via alleged Oracle PeopleSoft zero-day; FBI says it is investigating

Reuters / 404 Media · September 22, 2026

ShinyHunters claims to have breached the FBI through an unpatched Oracle PeopleSoft vulnerability, pivoted into AWS GovCloud infrastructure, and stolen 2–3 TB of data on agents and job applicants; apply.fbijobs.gov was defaced and currently shows a maintenance page. 404 Media verified some phone numbers in a roughly 5,000-record sample. The FBI told Reuters and BleepingComputer it is aware of the claims and investigating. No CVE has been published, Oracle has not commented, and the zero-day claim remains unverified.

“The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.” — FBI statement to Reuters

Source: Reuters · 404 Media · The Hacker News

Still developing

Three Linux kernel flaws added to KEV; Red Hat flags known exploits

CISA / Red Hat · September 18–19, 2026

CISA added CVE-2025-39682 (kTLS receive path, CVSS 9.8), CVE-2026-53266 (ebtables SNAT ARP out-of-bounds write, CVSS 8.8), and CVE-2025-39964 (AF_ALG race condition, CVSS 7.8) to KEV on September 18 with a September 21 federal deadline. Red Hat updated its advisories on September 19 to mark all three as having known exploits. Fixed upstream kernels have been available since 2025 for the two older bugs and since June 2026 for CVE-2026-53266.

Source: CISA alert (two) · CISA alert (one) · The Hacker News

Joint advisory: North Korea’s WaterPlum infected 30,000 devices, moved $10.7M in crypto

FBI / Japan NPA / ACSC / BfV · September 18, 2026

A joint advisory from U.S., Japanese, Australian, and German authorities attributes the “Contagious Interview” fake-recruiter campaign to WaterPlum, a unit under North Korea’s 313 General Bureau, and ties it to the DPRK IT-worker scheme. It names the BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle malware families and notes the actors’ use of AI face-swapping in video interviews.

“WaterPlum actors have infected at least 30,000 devices in more than 100 countries and exfiltrated funds or account credentials from over 7,000 cryptocurrency wallets.” — Joint cybersecurity advisory

Source: IC3 joint advisory (PDF) · BleepingComputer

ShinyHunters defaces Clop’s leak site, claims theft of onion keys

BleepingComputer · September 19, 2026

ShinyHunters breached and defaced the Clop ransomware gang’s Tor data leak site via what it says is an unauthenticated file upload flaw in Grav CMS, and claims to have taken source code, logs, and the onion service private keys. BleepingComputer confirmed the defacement but not the theft claims. The group frames it as retaliation in a feud dating to Clop’s 2025 Oracle E-Business Suite campaign.

Source: BleepingComputer

This brief covers the trailing ~48 hours (September 22–23, 2026).

Primary sources:

Leave a Reply