On September 22, the Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities catalog in a single alert. Two of them do not sit in ordinary business applications. They sit inside the consoles security teams use to run their own firewalls and identity infrastructure: Check Point’s Security Management Server and F5’s BIG-IP Access Policy Manager. Both were exploited by unauthenticated attackers before patches existed.
Two management planes, two zero-days, one week
Check Point’s flaw, CVE-2026-93616, is a pre-authentication path traversal in the Management Server’s web service, letting an attacker upload and execute an arbitrary script and load an arbitrary Java class with no credentials at all. Check Point rates it 9.8 on the CVSS scale and says a handful of customers were hit in targeted attacks starting July 23, weeks before the company shipped a fix on September 22. The same advisory disclosed a second, unrelated wave: attackers have been probing a previously patched VPN certificate flaw, CVE-2026-85102, since September 12, aimed specifically at customers of Spark, Check Point’s firewall line for small businesses.
F5’s flaw, CVE-2026-94127, is a heap-based buffer overflow in BIG-IP APM, also rated 9.8, also exploitable without authentication. It only triggers on a specific but common configuration: an APM access policy and an OAuth authorization server profile running on the same virtual server, the setup that turns a BIG-IP device into the OAuth token issuer applications trust. F5 disclosed the flaw and shipped hotfixes on September 22, the same day CISA added it to KEV alongside the Check Point bug.
Media Partner
Not either vendor’s first incident this month
Neither company is dealing with an isolated event. CyberTech reported in September on a separate pre-authentication root RCE in Check Point’s Management and Log Servers, and before that on two perfect-9.8 VPN certificate flaws, one of which is the same CVE-2026-85102 now under active attack. F5, meanwhile, disclosed a rootkit implant hiding inside BIG-IP APM’s own process memory less than two weeks before this new zero-day. The same product category, the same authentication-bypass failure mode, from two different vendors, inside the same rolling two-week window.
CISA’s alert did not single out the pattern; it grouped the two bugs mechanically with a third, an input-validation flaw in Arista’s VeloCloud SD-WAN software, under the same routine KEV update. But the agency’s own framing of why any of these four matters applies with particular force to the two sitting inside security infrastructure itself. “These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise,” CISA wrote in the alert.
What it means for the security leader
A management console is a force multiplier for an attacker in a way a single application server rarely is. Check Point’s Management Server pushes policy to every gateway it controls; an APM instance issuing OAuth tokens sits in the trust path for every application relying on those tokens. Compromise one console and the blast radius is every device or application downstream of it, which is exactly why CyberTech has separately covered an unauthenticated root RCE in Cisco’s identity gateway this quarter: the pattern is not confined to two vendors. Security and identity infrastructure has become a first-choice target precisely because it was built to be trusted by everything else on the network, and that trust relationship rarely gets the same internet-facing hardening, segmentation, and monitoring that a public web application does.
The economics behind that targeting choice are straightforward. Finding and weaponizing a pre-authentication path traversal or a heap overflow takes real engineering effort, and an attacker who spends that effort on a generic line-of-business application gets access to one organization. Spending the same effort on a management plane that hundreds or thousands of customers run gets access to all of them, scaled the moment a working exploit exists. That asymmetry is why these products keep drawing zero-day attention regardless of how mature any single vendor’s development process is: the payoff for finding the bug first does not depend on the vendor at all, only on how many downstream systems trust the console.
The instinct to treat a management console as an internal tool, reachable only by administrators who already trust it, is exactly the assumption these bugs break. All three of the recent Check Point flaws and F5’s two incidents required no valid credentials at all. CyberTech has previously documented how unevenly patch timelines move once a KEV entry lands, and a management-plane bug is the worst possible candidate for a slow patch cycle: every day it stays open is a day an attacker who compromises it inherits control over everything it manages, not just the one box.
What to do
Check Point customers should apply the September 22 hotfix for CVE-2026-93616 immediately, restrict Management Server access to trusted administrative networks rather than leaving it broadly reachable, and review logs for anomalous certificate-based VPN logins tied to the CVE-2026-85102 exploitation wave, particularly on Spark deployments. F5 customers should identify every virtual server that combines an APM access policy with an OAuth authorization server profile, since that specific combination is the only vulnerable configuration, apply the vendor hotfix or the iRule-based mitigation F5 published for systems that cannot patch immediately, and treat any BIG-IP device already flagged in this month’s PoisonedRefresh rootkit disclosure as needing a full integrity check, not just this week’s patch. Both incidents are federally mandated KEV remediations; treat that floor as the minimum, not the target. For either product, the same underlying question is worth asking regardless of this specific CVE: does the management console actually need to be reachable from the general network at all, or only from a small, explicitly allow-listed set of administrative hosts. Every one of the incidents named here required an attacker to reach the console’s web service in the first place.
Source: CISA
