Skip to content
Indene
en

Alertas de segurança

CISA Confirms Exploitation of Vulnerabilities in F5, Check Point, WSO2, and Arista

Between September 22 and 24, 2026, CISA added five critical vulnerabilities in VPN, API gateways, and corporate access to its catalog of exploited flaws. All are located at the network edge and all have patches: the remaining task is to apply them and confirm no prior unauthorized access.

By Leonardo Araujo IevaAnalista de segurança ofensiva

4 min read

Rede de pontos ligados por traços finos sobre fundo escuro esverdeado, com um único nó em âmbar aceso e o título Exploited flaws at the edge of the network.
Rede de pontos ligados por traços finos sobre fundo escuro esverdeado, com um único nó em âmbar aceso e o título Exploited flaws at the edge of the network.

The CISA, the cybersecurity agency of the United States government, included five critical vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog between September 22 and 24, 2026. These affect F5 BIG-IP APM, Check Point gateways and management servers, WSO2 API Manager, and Arista VeloCloud Orchestrator. All are located at the network edge or in access control, all can be exploited without authentication, and all already have vendor patches.

What is known

CVE Product Severity In KEV since US Federal Deadline
CVE-2026-94127 F5 BIG-IP APM CVSS v3.1 9.8; v4.0 9.3 September 22 September 25
CVE-2026-85102 Check Point Security Gateway and Spark (VPN) CVSS v3.1 9.8 September 22 September 25
CVE-2026-93616 Check Point Security Management and log servers CVSS v3.1 9.8 September 22 September 25
CVE-2026-5430 WSO2 API Manager and related products CVSS v3.1 10.0 (9.8 in single-tenant installation) September 24 September 27
CVE-2026-93952 Arista VeloCloud Orchestrator self-hosted CVSS v3.1 10.0; v4.0 9.5 September 22 September 25

The severity ratings are those from the manufacturers, registered in the NVD. The deadline applies to US civilian government agencies but serves as a benchmark for any company: CISA only adds vulnerabilities with confirmed exploitation to its catalog.

F5 BIG-IP APM. A memory overflow that allows code execution without authentication. This only exists when the APM acts as an OAuth authorization server, with an access policy and OAuth profile on the same virtual server. It affects versions 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3. F5 confirmed the exploitation and published a hotfix for each branch; those who cannot update should request an iRule for mitigation from support. Shadowserver identifies over 14,700 IP addresses with a BIG-IP APM signature on the internet, according to BleepingComputer, without knowing how many are patched.

Check Point. CVE-2026-85102 is an improper certificate validation during VPN negotiation, allowing code execution on the gateway. The fix has been available since September 9, and Check Point observed a wave of attempts against Spark clients starting September 12. CVE-2026-93616 is in the management web service (Security Management, Multi-Domain, Log Server, and SmartEvent) and allows sending and executing scripts. Check Point recorded a few isolated attacks on July 23. Without the fix, the recommendation is to restrict TCP port 19009 to trusted addresses.

WSO2. The JWT authentication mechanism accepts tokens signed with an unconfigured algorithm, which allows forging access, including administrator access. It affects API Manager versions 4.1.0 to 4.6.0 and API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. The vendor advisory was issued on May 3, 2026. watchTowr captured the first forged token on September 13 and states that it grants access to all published APIs, with the credentials, keys, and secrets of each registered application, according to SecurityWeek.

Arista VeloCloud Orchestrator. An input validation flaw in the self-hosted SD-WAN orchestrator, which grants access to privileged server functions. It affects versions up to 5.2.3.15, 6.1.3.7, 6.4.2.7, and 7.0.0.2 of each branch. The fix is in 5.2.3.16 and 6.4.2.8; Arista-hosted versions have already been patched. Without the fix, Arista recommends limiting the web interface to trusted administrative networks.

Why it matters for financial institutions

These four products are at the entry point: the remote employee's VPN, the server that issues access tokens, the gateway that exposes APIs to partners, and the orchestrator that controls the branch network. Whoever controls one of these does not need a password to access the rest. This is a scenario of exploiting internet-exposed assets, and in the case of WSO2 and F5, also corporate account compromise. WSO2 serves banks, government, telecommunications, and logistics, according to SecurityWeek.

Updating does not prove that no one entered. For BIG-IP, CISA itself advises applying the iRule first, performing forensic triage, and only then installing the definitive fix, to avoid erasing traces. For WSO2, the risk remains after the patch if application keys have already been read.

The same applies to third parties: SD-WAN and VPN are often operated by a network provider. The question to the vendor is the same as to the internal team.

What to do now

  1. Verify if your institution, or a vendor operating the network on its behalf, uses any of the four products and if the access or management interface is exposed to the internet.
  2. Apply the fix indicated in each manufacturer's advisory: F5 hotfix, Check Point SK1000117 and SK1000171, WSO2-2026-5328 update, and patched VeloCloud version.
  3. If you cannot patch today, apply the official mitigation: F5 iRule, Check Point management TCP port 19009 restricted to trusted addresses, VeloCloud interface only on the administrative network.
  4. Look for signs of unauthorized access since the known exploitation dates (July 23 for Check Point management, September 12 for VPN, September 13 for WSO2) and change the keys and secrets of applications published on the API gateway.
  5. Document the fix and verification with date and responsible party: this is the evidence auditors will request.

References

Topics

Keep reading

All news