cisa.govadvisoryCISA KEV Catalog Additions — Check Point, Arista VeloCloud, F5 BIG-IP (Sept 22, 2026)
CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog on 2026-09-22 based on evidence of active exploitation: two Check Point multi-product flaws (improper certificate validation CVE-2026-85102, path traversal CVE-2026-93616), an Arista VeloCloud Orchestrator improper input validation bug (CVE-2026-93952), and an F5 BIG-IP APM heap-based buffer overflow (CVE-2026-94127). The alert ties the additions to BOD 26-04, which has FCEB agencies prioritize remediation of KEV CVEs on publicly exposed assets that give total control, and to checking for prior compromise before patching.
TL;DR CISA adds four exploited CVEs to KEV: two Check Point, Arista VeloCloud Orchestrator, F5 BIG-IP APM (Sept 22, 2026).
Organisations named here
- BOD 26-04
- CISA
CVEs named here
- CVE-2026-85102
- CVE-2026-93616
- CVE-2026-93952
- CVE-2026-94127
Technologies named here
- Check Point Multiple Products
- Arista VeloCloud Orchestrator
- Binding Operational Directive 26-04
- F5 BIG-IP APM
- CISA KEV
- Check Point
- F5 Big-IP
Techniques named here
- Path traversal
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup