CISA KEV Alert: Check Point, Arista VeloCloud, and F5 BIG-IP APM CVEs Under Active Exploitation — Detection and Remediation Guide

CISA has added four vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-85102 and CVE-2026-93616 affecting multiple Check Point products, CVE-2026-93952 affecting Arista VeloCloud Orchestrator, and CVE-2026-94127 affecting F5 BIG-IP APM. These are not hypothetical bugs. KEV inclusion means defenders should assume exploit code is usable in the wild and that internet-facing or management-plane exposure is being probed now.

The common thread is the attack surface defenders consistently underestimate: security and network edge platforms that terminate sessions, enforce policy, orchestrate SD-WAN, broker access, or authenticate users. When those platforms fail, the blast radius is not a single endpoint — it is trust boundaries, remote access, segmentation, and traffic inspection. Federal Civilian Executive Branch agencies are bound by BOD 26-04 and the KEV remediation dates in the catalog; private-sector organizations should treat the same dates as a forcing function because ransomware operators, initial-access brokers, and state-aligned crews monitor KEV additions closely.

Act in this order: identify exposed instances, apply vendor fixes or approved mitigations, restrict management-plane reachability, review logs backward for compromise indicators, and only then return systems to normal exposure.

Technical Analysis

Affected products and CVEs

• CVE-2026-85102 — Check Point Multiple Products: Improper Certificate Validation. The defective behavior is certificate validation logic across multiple Check Point products. From a defender's perspective, the risk is that an attacker can present a malformed, spoofed, or otherwise invalid certificate chain that the affected component accepts or mishandles, undermining TLS trust for management, VPN, inspection, or inter-component communications depending on product role.
• CVE-2026-93616 — Check Point Multiple Products: Path Traversal. A path traversal flaw in multiple Check Point products can allow crafted requests to escape intended directories and read or interact with files outside the expected web root or service path. On appliances, even limited file read can expose configuration blobs, session artifacts, keys, local user databases, logs, or diagnostic files.
• CVE-2026-93952 — Arista VeloCloud Orchestrator: Improper Input Validation. VeloCloud Orchestrator is high-value because it centralizes SD-WAN management. Improper input validation can be leveraged to drive unexpected application state, unauthorized actions, or chained exploitation against orchestration functions. Defenders should prioritize interfaces reachable by branch devices, admins, service accounts, and automation.
• CVE-2026-94127 — F5 BIG-IP APM: Heap-based Buffer Overflow. BIG-IP Access Policy Manager sits in the authentication and remote-access path. A heap-based overflow is especially concerning because crashes can become denial of service, and memory corruption in a privileged network service can become code execution depending on exploit maturity and mitigations. Treat APM virtual servers and management exposure as urgent review items.

The source item does not provide CVSS scores, fixed version numbers, or full exploit prerequisites. Do not invent them. Pull the exact affected/fixed builds from the vendor advisory for your product train and map them to the KEV due date. If your asset inventory cannot tell you which Check Point products, VeloCloud Orchestrator nodes, or BIG-IP APM modules are installed and reachable, that inventory gap is itself a critical finding.

Attack chain and exploitation requirements

For edge appliances, the practical chain is usually: discover exposed management or service interface, fingerprint product/version, send crafted request or malformed TLS/object/input, gain file access, auth bypass, memory corruption, or orchestration abuse, then harvest credentials/config, implant persistence where supported, pivot inward, or weaken policy. Internet-facing exposure raises urgency, but do not ignore internal-only instances: once an intruder has any foothold, these platforms become force multipliers for credential theft and lateral movement.

Exploitation status

All four CVEs are in CISA KEV based on evidence of active exploitation. Treat them as confirmed exploited, not theoretical. Assume scanning will spike after KEV publication and after vendor advisories are indexed by exploit brokers and botnet operators.

Detection & Response

Prioritize telemetry from load balancers, reverse proxies, WAFs, VPN gateways, SD-WAN orchestration logs, authentication services, syslog/CEF forwarding, firewall logs, EDR on adjacent jump hosts, and change-control systems. Many appliances do not run full EDR, so network and management-plane telemetry are often the only reliable tripwires.

---
title: Edge Management Interface Path Traversal Probe
id: 3c5a4f8e-9b21-4d0e-8f6a-2b7c9d1e0a11
status: experimental
description: Detects traversal patterns in requests to network/security appliance management or service URIs, relevant to Check Point path traversal exposure and orchestrator input abuse.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/09/23
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%252e%252e%252f'
      - '..%c0%af'
      - '/etc/passwd'
      - '/windows/win.ini'
      - 'boot.ini'
      - 'WEB-INF/web.xml'
  selection_edge:
    cs-host|contains:
      - 'checkpoint'
      - 'velocloud'
      - 'bigip'
      - 'apm'
      - 'mgmt'
      - 'admin'
  condition: selection_uri and selection_edge
falsepositives:
  - Poorly written scanners or monitoring tools
  - Application paths legitimately containing encoded dots
level: high
---
title: Suspicious Process Spawned by Network Appliance or Controller Host
id: 7f0b2d44-6a18-4c9a-b3d1-5e8a9c0f2b22
status: experimental
description: Detects common post-exploitation shells or download tools spawned on Linux hosts running edge/controller software where such processes are unusual.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/09/23
tags:
  - attack.execution
  - attack.t1059
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/opt/'
      - '/usr/lib/'
      - 'velocloud'
      - 'orchestrator'
      - 'httpd'
      - 'nginx'
      - 'java'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/perl'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor support scripts and approved maintenance
  - Backup or monitoring agents invoking shell
level: medium

// Sentinel/Defender hunt: edge appliances and controller hosts sending suspicious web hits, auth anomalies, or process execution
let lookback = 14d;
let edgeNames = dynamic(["checkpoint","check point","velocloud","orchestrator","bigip","big-ip","f5","apm"]);
CommonSecurityLog
| where TimeGenerated >= ago(lookback)
| extend d = tolower(coalesce(DeviceName, SourceHostName, DestinationHostName, ""))
| where d has_any (edgeNames)
| where RequestURL has_any ("../","%2e%2e","/etc/passwd","win.ini","boot.ini") or Message has_any ("certificate","invalid cert","path traversal","buffer","overflow","heap","authentication failed","new admin","config changed")
| project TimeGenerated, DeviceName, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, RequestMethod, RequestURL, Message, Severity
| sort by TimeGenerated desc;
SecurityEvent
| where TimeGenerated >= ago(lookback)
| where EventID in (4624,4625,4672,4732,4728,4756,4720)
| extend ComputerLower = tolower(Computer)
| where ComputerLower has_any (edgeNames) or IpAddress has_any ("10.","172.16.","192.168.")
| project TimeGenerated, Computer, Account, LogonType, IpAddress, EventID, Activity
| sort by TimeGenerated desc;
DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where InitiatingProcessFileName in~ ("httpd","nginx","java","svchost.exe") or FileName in~ ("curl","wget","powershell.exe","bash","sh","python","perl","nc","ncat")
| where ProcessCommandLine has_any ("http://","https://","/tmp/","-enc","frombase64string","certutil","bitsadmin","Invoke-WebRequest")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| sort by TimeGenerated desc

-- Hunt Linux hosts that may run controller components or act as admin jump hosts to edge appliances
LET suspicious <= SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(curl|wget|nc |ncat|base64 -d|/tmp/|/dev/shm|chmod \+x|bash -i|sh -i)'
   OR Exe =~ '/(tmp|dev/shm|var/tmp)/'

LET conns <= SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, State
FROM netstat()
WHERE RemotePort in (443, 8443, 9443, 8080, 22)
  AND State =~ 'ESTABLISHED|LISTEN'

SELECT * FROM suspicious
UNION ALL
SELECT Pid, NULL AS Ppid, Name, LocalAddress + ':' + LocalPort AS CommandLine, RemoteAddress + ':' + RemotePort AS Exe, State AS Username, NULL AS CreateTime FROM conns

#!/usr/bin/env bash
# KEV triage helper for Check Point / Arista VeloCloud / F5 BIG-IP APM exposure.
# Run from an admin workstation. It inventories likely targets, checks reachability of management/service ports,
# captures local BIG-IP version if tmsh is available, and writes a prioritized report. It does not patch.
set -euo pipefail
OUT="kev_2026_09_triage_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUT"
TARGETS="${1:-targets.txt}"   # one host/IP per line; use your CMDB export, not guesses
PORTS="443 8443 9443 8080 22 161"

echo "[+] Collecting local platform evidence" | tee "$OUT/local_platform.txt"
{
  date -u
  uname -a
  if command -v tmsh >/dev/null 2>&1; then
    echo "--- F5 tmsh version/module evidence ---"
    tmsh show sys version 2>/dev/null || true
    tmsh list sys provision 2>/dev/null || true
    tmsh list apm 2>/dev/null | head -200 || true
  fi
  if command -v clish >/dev/null 2>&1; then
    echo "--- Check Point clish present; run: show version all / show hostname ---"
  fi
  if [ -d /opt/velocloud ] || [ -d /opt/vco ] || systemctl list-units 2>/dev/null | grep -qi velocloud; then
    echo "--- Possible VeloCloud Orchestrator artifacts present ---"
    systemctl list-units 2>/dev/null | grep -i velocloud || true
  fi
} >> "$OUT/local_platform.txt" 2>&1 || true

if [ -f "$TARGETS" ]; then
  echo "[+] Testing management/service reachability (expected exposure should be narrow)" | tee "$OUT/reachability.tsv"
  printf "host\tport\topen\n" >> "$OUT/reachability.tsv"
  while read -r h; do
    [ -z "$h" ] && continue
    for p in $PORTS; do
      if timeout 3 bash -c "</dev/tcp/$h/$p" >/dev/null 2>&1; then
        printf "%s\t%s\tOPEN\n" "$h" "$p" >> "$OUT/reachability.tsv"
      else
        printf "%s\t%s\tclosed/filtered\n" "$h" "$p" >> "$OUT/reachability.tsv"
      fi
    done
  done < "$TARGETS"
fi

cat > "$OUT/ACTIONS.txt" <<'EOF'
Immediate actions:
1) Pull exact fixed builds from vendor advisories for CVE-2026-85102, CVE-2026-93616, CVE-2026-93952, CVE-2026-94127; do not rely on this script for versions.
2) Check CISA KEV due dates and BOD 26-04 applicability; document due date, owner, and compensating control if patching is blocked.
3) Remove internet exposure of management interfaces; restrict to a dedicated admin VRF/VLAN and named jump hosts.
4) Enforce MFA/phishing-resistant auth for admins, rotate appliance-local credentials and API tokens, review new admin accounts and config changes back 30-90 days.
5) Preserve logs before reboot/patch: syslog, auth logs, HTTP access logs, config backups, crash/core files, and vendor diagnostics.
6) If compromise is suspected, isolate, snapshot/backup config, rotate credentials from a known-clean host, and open IR before wiping evidence.
EOF

echo "[+] Wrote $OUT. Review reachability.tsv for unexpectedly open ports and ACTIONS.txt for containment steps."

Remediation

1. Confirm exposure and ownership today. Build or validate a list of every Check Point product instance, Arista VeloCloud Orchestrator node, and F5 BIG-IP APM configuration. Include management IPs, virtual servers, self-IPs, admin portals, API endpoints, HA peers, cloud instances, and forgotten lab appliances. KEV response fails most often because an unmanaged secondary node or old partner-access portal is missed.
2. Patch to the vendor-fixed build for your exact train. The news item does not list fixed versions or CVSS scores; obtain them from the vendor advisory mapped to each CVE and your installed release. Use official sources only: Check Point Support Center advisories, Arista support/security advisories for VeloCloud Orchestrator, F5 Security Advisories for BIG-IP APM, and the CISA alert at https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog plus the KEV catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog.
3. Meet KEV/BOD 26-04 dates or formally isolate. If you are an FCEB agency, remediate by the KEV due date under BOD 26-04. If you are not FCEB, adopt the same deadline internally. Where a patch cannot be applied immediately, remove the interface from untrusted networks, place it behind an authenticated admin gateway, disable the vulnerable feature only if the vendor explicitly says that is a valid mitigation, and document the exception with an expiry date.
4. Reduce the management plane permanently. Management and orchestration interfaces should never be reachable from the general internet. Enforce source IP allowlists, admin VLAN/VRF segmentation, phishing-resistant MFA, named jump hosts, just-in-time admin access, and explicit deny rules for unexpected countries/ASNs only as a secondary control. Log every successful and failed admin authentication.
5. Hunt backward before declaring clean. Review at least the last 30-90 days for traversal requests, certificate validation errors, repeated TLS handshake anomalies, new local or remote admin accounts, sudden configuration exports, unplanned policy pushes, unexpected software images, crash/core dumps on BIG-IP APM, reboots outside maintenance windows, and egress from appliances to uncommon destinations. Preserve evidence before patching if exploitation is plausible.
6. Rotate secrets after suspected exposure. If logs show probing that reached authentication, file access, crashes, or config changes, rotate appliance credentials, VPN/user credentials where cached, API tokens, certificates/private keys if there is any chance of disclosure, SNMP strings, RADIUS/TACACS+ shared secrets, and automation/service accounts from a known-clean workstation.
7. Add preventive controls. Keep appliances on supported trains, subscribe to vendor security RSS/email, require change control for config and hotfixes, send appliance syslog/CEF to Sentinel/Splunk, alert on config changes outside approved tickets, test restores, and include edge-device compromise in ransomware IR playbooks.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub