Cyber Threat Brief — September 23 2026
1. F5 BIG-IP APM OAuth AuthZ Server Unauth RCE — CVE-2026-94127 (CISA KEV)
TL;DR: F5 + CISA (2026-09-22): CVE-2026-94127 (CVSS 9.8) heap overflow on BIG-IP APM OAuth Authorization Server VIPs (access policy + OAuth AuthZ profile) → unauthenticated RCE on the data plane (Appliance mode included; mgmt lockdown does not help). Federal KEV due 2026-09-25, forensic triage Yes. Hotfixes per branch; temporary iRule from F5 Support for triage-first.
What’s New:
- First public ITW + KEV for this CVE (F5 internal find; CISA + CERT-EU + THN/BC)
- Scope narrowed 2026-09-23 00:45 UTC: AuthZ Server only — Client/Resource Server profiles not affected
- PoisonedRefresh (CVE-2025-53521) patched builds 17.1.3 / 17.5.1.3 still need this hotfix if AuthZ Server
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-94127 on BIG-IP APM 21.1.0 / 17.5.0–17.5.1 / 17.1.0–17.1.3 with OAuth Authorization Server profile on VIP | Vulnerable VIP / KEV | T1190 | F5 inventory / TMSH / CMDB | Install Eng HF: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG / 17.5.1.9.0.160.12-ENG / 17.1.3.5.0.41.14-ENG; else open F5 case for iRule, then patch; finish forensic triage before 2026-09-25 |
| Config path Access → Federation → OAuth Authorization Server → OAuth Profile attached to VIP access profile | Exposure condition | T1190 | BIG-IP GUI / TMSH | Inventory every VIP with AuthZ Server profile; prioritize internet-facing; Client/RS-only = out of scope |
APM log /var/log/apm: ≥10 failed UserInfo from one IP with “The access token is invalid” → suspicious cmds in /var/log/audit → TMM SIGABRT / SOD | Exploit IoC chain (F5/CERT-EU) | T1190 / T1059 | APM + audit + SOD | Correlate that triad; preserve cores; assume RCE until proven otherwise |
tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed unexplained total_failed rise | Telemetry | T1190 | BIG-IP shell | Baseline then alert spikes coinciding with UserInfo fails |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2026-94127 / OAuth UserInfo. Rejected F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 (Web.url=*/mgmt/tm/util/bash* POST) — TMUI/iControl 2022 path, not APM OAuth AuthZ heap overflow | No APM OAuth AuthZ analytic |
| Elastic | None — verified search | No CVE-2026-94127 / APM OAuth rule |
| Sigma | None — verified search. Rejected web_cve_2020_5902_f5_bigip — different TMUI CVE | No emerging-threat rule for this CVE |
Hunt hint: (1) List APM AuthZ Server VIPs. (2) Apply iRule → Eng HF before 2026-09-25. (3) Hunt /var/log/apm invalid-token UserInfo bursts + audit cmds + TMM SIGABRT. (4) Patch ≠ eviction — triage for prior foothold.
Sources: CISA KEV alert 2026-09-22, F5 K000162605, The Hacker News, BleepingComputer, SecurityWeek
2. Check Point Management Pre-Auth Path Traversal RCE — CVE-2026-93616 (CISA KEV)
TL;DR: Check Point + CISA (2026-09-22): CVE-2026-93616 (CVSS 9.8) pre-auth path traversal on Management web service → upload/execute arbitrary script + load arbitrary Java class. Handful of pinpointed ITW (observed ~2026-07-23). Affects SMS / MDS / Log / MDS Log / SmartEvent. KEV due 2026-09-25, forensic triage Yes. LivePatch does not fix. Same-day KEV also covers VPN CVE-2026-85102 ITW (see Status).
What’s New:
- New zero-day on management plane (distinct from Sep 18 SMS CVE-2026-91843 / VPN 85102/85103)
- Fixes: R82.20 Security Hotfix TAR; Jumbos R82.10 Take ≥45, R82 ≥127, R81.20 ≥170, R81.10 ≥192
- Vendor IoCs in
cpm.elg: username >1000 chars + concurrent FWM/MDS core;ReflectionUtilsFailed to load allResourceFiles map from with../
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-93616 on Check Point SMS / MDS / Log / MDS Log / SmartEvent (R82.20; R82.10 JH ≤44; R82 JH ≤126; R81.20 JH ≤166; R81.10 JH ≤190; R80.x/R81 EoS) | Vulnerable mgmt / KEV | T1190 / T1059 | Asset inventory / SmartConsole | Apply R82.20 HF or listed Jumbo Takes; do not rely on LivePatch Take 28/29; forensic triage before 2026-09-25 |
Expert: grep -nHP "username='[^']{1001,}'" "$MDS_FWDIR"/log/cpm.elg* then ls -l /var/log/dump/usermode/ | grep -e fwm -e mds same timestamp | Exploit attempt IoC | T1190 | cpm.elg* / usermode dumps | Treat long-username login + FWM/MDS core as exploit attempt; hunt back to ≥2026-07-23 |
Expert: grep -E "ERROR.*upgrade\.base\.ReflectionUtils.*Failed to load allResourceFiles map from" $MDS_FWDIR/log/cpm.elg* paths with ../ (e.g. /opt/CPupgrade-tools-../../../../tmp/...) | Traversal IoC | T1190 / T1059 | cpm.elg* | Quarantine host; hunt scripts/Java classes under /tmp; rotate mgmt creds/keys |
| Compensating: Trusted Clients + TCP/19009 only from admin jump hosts | Exposure control | T1190 | SmartConsole Trusted Clients / firewall | Harden until Jumbo/HF installed; still patch |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2026-93616 / cpm.elg / ReflectionUtils. NailaoLocker story tracks older gateway CVE — misses this management path traversal | No Check Point SMS path-traversal analytic |
| Elastic | None — verified search | No CVE-2026-93616 rule |
| Sigma | None — verified search | No emerging-threat rule for this CVE |
Hunt hint: (1) Patch SMS estate to listed Takes. (2) Run both sk1000171 greps on every SMS/MDS/Log/SmartEvent. (3) Review unexpected scripts/Java loads, Trusted Clients edits, policy publishes since 2026-07-23. (4) Patch ≠ clean — rotate secrets if IoCs hit.
Sources: CISA KEV alert 2026-09-22, Check Point sk1000171, Check Point Research blog, BleepingComputer, SecurityWeek
3. Arista VeloCloud Orchestrator Unauth Privileged Access — CVE-2026-93952 (CISA KEV)
TL;DR: Arista SA-0183 + CISA (2026-09-22): CVE-2026-93952 (CVSS 10.0) improper input validation on on-prem VeloCloud Orchestrator with certificate-based Edge→VCO auth → remote unauth privileged internal access / host impact (may pivot to managed Edges). Actively exploited. Fixed: 5.2.3.16+, 6.4.2.8+; 6.1 / 7.0 fixes pending. KEV due 2026-09-25, forensic triage Yes. Hosted/Dedicated already patched by Arista.
What’s New:
- Second VCO ITW class after July CVE-2026-16812; July-patched builds can still be vulnerable to 93952
- Requires attacker possession of Edge auth cert public portion + reachability to VCO web UI (no tenant/operator creds)
- Concrete post-exploit IoCs:
/usr/local/sbin/.vcnode.js,vc-sysmond(MD5dc78e206eaeadec59fc5801fe4556bd0),vc-sysmon.service, nginx headerx-vc-opt, IPs142.93.149.77/104.248.126.159
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-93952 on VCO on-prem ≤5.2.3.15 / ≤6.1.3.7 / ≤6.4.2.7 / ≤7.0.0.2 with cert-based Edge auth | Vulnerable orchestrator / KEV | T1190 | VCO version / SD-WAN inventory | Upgrade to ≥5.2.3.16 or ≥6.4.2.8 (or TAC for 6.1/7.0); restrict VCO web to admin nets; forensic triage before 2026-09-25 |
Files /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond (MD5 dc78e206eaeadec59fc5801fe4556bd0), unit /etc/systemd/system/vc-sysmon.service | Persistence IoC | T1543.002 / T1505 | FIM / EDR / host inventory | If any present: preserve state, contact Arista TAC, isolate VCO, rotate Edge/orchestrator creds & certs |
Nginx/VCO access: HTTP header x-vc-opt; sources 142.93.149.77, 104.248.126.159 | Network IoC | T1071 | Nginx / VCO web access / firewall | Block+hunt those IPs; alert on x-vc-opt; review encoded/unusual URL paths + high request rate |
| Unexpected egress HTTP(S) from VCO host; odd admin/config changes | Post-exploit | T1041 / T1098 | Netflow / VCO app + system logs | Hunt outbound from VCO; validate Edge inventory; restore from trusted backup if compromised |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Linux Service File Created In Systemd Directory (Filesystem.file_name=*.service under /etc/systemd/system*) may catch vc-sysmon.service drop only | Misses exploit HTTP stage, .vcnode.js, x-vc-opt, IoC IPs |
| Elastic | Partial — Systemd Service Created (service unit under /etc/systemd/system/) — same persistence-only catch | No VeloCloud / CVE-2026-93952 exploit analytic |
| Sigma | Partial — Systemd Service Creation (auditd PATH CREATE under /etc/systemd/system/) — persistence only | No emerging-threat rule for CVE-2026-93952 |
Hunt hint: (1) Inventory VCO versions + cert-auth mode. (2) FIM for .vcnode.js / vc-sysmond / vc-sysmon.service. (3) Block IoC IPs; grep nginx for x-vc-opt. (4) After upgrade: rotate credentials/certs; verify Edge state.
Sources: CISA KEV alert 2026-09-22, Arista Security Advisory 0183, The Hacker News, BleepingComputer
Status Updates
- Chrome CVE-2026-87491: KEV due was TODAY 2026-09-23 — confirm Chromium ≥153.0.8010.36 class fleet-wide; Volexity UTA0565 / CLEANGULP reused BlueMoon (CVE-2026-85046+87491+85880) via fake CAP/China Digital Times sites (
chinadigitaltimes[.]top,americanprgoress[.]top, C2thecovnresation[.]com, dropchrome_cleanup.exe). Original brief · Sep 10 · Sep 11 BlueMoon - CVE-2026-7273 (Zyxel GS1900): KEV due 2026-09-24 (forensic triage Yes) — finish 2.90(*.2)C0 + Kapibala IoC hunt. Sep 22
- CVE-2026-42016/CVE-2026-42018 (JFrog): KEV due 2026-09-25 — continue
POST /access/api/v1/aws/token/+token:anonymoushunts. Sep 12 - CVE-2026-85102 (Check Point VPN/Spark): NEW on KEV (2026-09-22, due 2026-09-25, forensic triage Yes) — vendor now confirms global Spark ITW since ~2026-09-12; cert subjects observed
CN=vpn|vpn-user|vpnuser,OU=users,O=global; patch per sk1000117. Sep 11 - Windows CVE-2026-81963 + CVE-2026-85880: KEV due was 2026-09-22 — confirm Sep 2026 LCU; keep ALPC/
chrome.exe→SYSTEM and Update Stack hunts. Sep 09 - CVE-2026-32996 (Veeam) / CVE-2026-93485 (Comment2Shell): No material change — keep Agent 13.0.3.1220 + WP ≥7.1.1 hunts. Sep 22
- ChainScript / Jade Sleet / npm indexed-btree / WaterPlum / Discourse 32882 / Orkes 58138 / Brevo ClickFix / CP SMS 91843: No material change — keep prior hunts. Sep 21 · Sep 20 · Sep 19 · Sep 18