Cyber Centre Daily Advisory Digest — 2026-09-22 (3 advisories)
Four actively exploited CVEs across Arista VeloCloud, Check Point VPN gateways and Management Server, and F5 BIG-IP APM demand immediate patching of perimeter network infrastructure. Active exploitation targets CVE-2026-93952 in Arista VeloCloud Orchestrator, CVE-2026-85102 and CVE-2026-93616 in Check Point Security Gateway and Management Server, and CVE-2026-94127 in F5 BIG-IP APM. All four enable unauthenticated remote attacks on perimeter network devices. An additional Check Point CVE-2026-85103 (ASN.1 heap overflow RCE) is disclosed but not confirmed exploited.
Detection / Hunteropenrouter
Immediate Actions
- Apply vendor patches for all five CVEs on affected Arista, Check Point, and F5 devices immediately
- Restrict management interfaces to dedicated admin VLANs; block internet exposure
- If patching is delayed, disable Remote Access VPN on affected Check Point gateways
- Monitor for anomalous authentication and administrative sessions on all affected appliances
Key Takeaways
- CVE-2026-85102 enables authentication bypass and RCE in Check Point Remote Access and Site-to-Site VPN
- CVE-2026-93616 is a pre-authentication vulnerability in Check Point Security Management Server
- CVE-2026-93952 affects Arista VeloCloud Orchestrator On-Prem versions 5.2 through 7.0
- CVE-2026-94127 targets F5 BIG-IP APM across versions 17.1 through 21.1
- CVE-2026-85103 (ASN.1 heap overflow RCE) in Check Point disclosed but not confirmed exploited in the wild
Attack Chain
- Reconnaissance: Attackers identify internet-exposed Check Point VPN gateways, F5 BIG-IP APM, and Arista VeloCloud Orchestrator instances
- Initial Access: Unauthenticated exploitation of CVE-2026-85102 (Check Point VPN auth bypass) or CVE-2026-93616 (Management Server pre-auth)
- Execution: Remote code execution achieved via the exploited vulnerability on the network appliance
- Persistence: Attacker maintains access on compromised perimeter device to intercept or redirect traffic
- Lateral Movement: Compromised VPN gateway or management server used as pivot point into internal network
Affected Systems
- Arista VeloCloud Orchestrator (VCO) On-Prem 5.2.0–5.2.3.15
- Arista VeloCloud Orchestrator (VCO) On-Prem 6.1.0–6.1.3.7
- Arista VeloCloud Orchestrator (VCO) On-Prem 6.4.0–6.4.2.7
- Check Point Security Gateway and Spark Firewall with VPN
- Check Point Security Management Server (multiple versions)
- F5 BIG-IP versions 17.1.0 through 21.1.0
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-93952 | Arista VeloCloud Orchestrator (VCO) On-Prem | Vulnerability in VCO On-Prem exploited in the wild; details not specified. | |
| CVE-2026-85102 | Check Point Security Gateway / Spark Firewall (VPN) | Authentication bypass and remote code execution in Remote Access and Site-to-Site VPN. | |
| CVE-2026-85103 | Check Point Security Gateway | ASN.1 decoding heap overflow leading to remote code execution. | |
| CVE-2026-93616 | Check Point Security Management Server | Pre-authentication vulnerability in Security Management Server exploited in the wild. | |
| CVE-2026-94127 | F5 BIG-IP APM | BIG-IP APM vulnerability exploited in the wild; details not specified. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Network appliances typically lack EDR agents; exploitation occurs on the appliance itself. |
| Network Visibility | Medium | Inbound traffic to VPN gateways and management interfaces may be monitored; east-west from compromised appliance likely not. |
| Detection Difficulty | Hard | Exploitation of pre-auth vulnerabilities on network appliances produces minimal telemetry without specialized appliance logging. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Unexpected administrative sessions originating from VPN gateway or management server IP addresses after authentication bypass exploitation (T1190; T1078). | VPN auth logs, firewall session logs | Initial Access | Medium — legitimate admin sessions from VPN gateways |
| Outbound connections from F5 BIG-IP or Check Point appliance management plane to unknown external destinations indicating post-exploitation C2 (T1071). | Network flow data, egress firewall logs | Command and Control | Low — appliances rarely initiate outbound to unknown IPs |
Required Log Sources
- Check Point SmartDefense logs
- F5 BIG-IP ASM logs
- Arista VCO system logs
- Firewall ingress/egress logs
- VPN authentication logs
- Network flow data
Key Behavioral Indicators
- Authentication events on Check Point Management Server without preceding credential submission
- Rapid succession of unauthenticated requests to BIG-IP APM endpoints
- New or unexpected processes spawned on network appliance OS shells
- Outbound network connections from appliance management plane to external IPs
Control Gaps
- Network appliances lack endpoint detection and response coverage
- Management interface exposure to the internet enables exploitation
- Insufficient logging on network appliance exploitation attempts
False Positive Assessment
Low — exploitation of pre-auth vulnerabilities on network appliances produces distinct anomalous patterns; legitimate admin activity is infrequent and from known sources.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enforce network-level ACLs permitting management access only from jump hosts
- Enable full logging on all VPN gateways, management servers, and BIG-IP APM modules
- Segment network appliance management planes from user data planes
- Deploy WAF or IPS signatures for CVE-2026-85102 and CVE-2026-93616 if available
User Protection
- Require MFA for all VPN sessions regardless of patch status
- Notify remote workers of potential VPN gateway downtime during emergency patching
- Rotate VPN pre-shared keys and certificates after patching Check Point gateways
MITRE ATT&CK Mapping
Initial Access
Plain-Language Summary
Three major network equipment vendors—Arista, Check Point, and F5—have disclosed serious security flaws in their products, and attackers are already exploiting most of them. The affected devices include VPN gateways, network management servers, and traffic management appliances that sit at the edge of corporate networks. Organizations using these products should apply vendor patches immediately and restrict access to management interfaces.
- cveCVE-2026-85102Authentication bypass and remote code execution in Remote Access and Site-to-Site VPN.
- cveCVE-2026-85103ASN.1 decoding heap overflow leading to remote code execution.
- cveCVE-2026-93616Pre-authentication vulnerability in Security Management Server exploited in the wild.
- cveCVE-2026-93952Vulnerability in VCO On-Prem exploited in the wild; details not specified.
- cveCVE-2026-94127BIG-IP APM vulnerability exploited in the wild; details not specified.