Critical Zero-Day Exploits Target F5 and Check Point Products

• •F5's CVE-2026-94127 and Check Point's CVEs are actively exploited zero-days with CVSS scores of 9.8.
• •CISA has added these vulnerabilities to its KEV catalog, highlighting their critical nature.
• •Affected systems include F5 BIG-IP and Check Point Security Gateways, requiring urgent patching.

F5 Networks released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager on September 22, 2026, after confirming active exploitation. This flaw allows unauthenticated remote code execution (RCE) and has a CVSS score of 9.8. Concurrently, Check Point disclosed two vulnerabilities, CVE-2026-85102 and CVE-2026-93616, both rated 9.8, with confirmed exploitation starting shortly after their respective patches were released. CVE-2026-85102 affects VPN gateways and exploits improper certificate handling, while CVE-2026-93616 allows RCE via path traversal in the Security Management web service. CISA added all three vulnerabilities to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch by September 25, 2026. The vulnerabilities are particularly concerning as they affect critical edge devices, increasing the risk of credential theft and lateral movement within networks.