KEV Intelligence Brief — September 23, 2026

Classification: TLP:CLEAR | Audience: Federal Contractors, DevOps, SecOps Leadership Reporting Period: September 18–22, 2026 | Prepared: September 23, 2026

Eight new entries hit CISA's Known Exploited Vulnerabilities catalog across the past five days, spanning network security infrastructure, SD-WAN orchestration, and the Linux kernel. The pattern is stark: threat actors are actively targeting perimeter enforcement layers and the foundational OS underpinning most enterprise workloads. Three of these deadlines have already passed.

Deadline Watch: Perimeter Infrastructure Under Active Exploitation

The most operationally urgent cluster involves Check Point, Arista, and F5 — all carrying a September 25 patch deadline (two days from publication of this brief) under BOD 26-04. A secondary cluster from Zyxel expired September 24, meaning it is effectively overdue as of today.

CVE-2026-85102 is the highest-priority entry in this cohort. Check Point Security Gateway and Spark Firewall are affected by an improper certificate validation flaw in their Site-to-Site and Remote Access VPN implementations that allows unauthenticated remote code execution on the gateway itself. This is a direct, pre-auth RCE on your VPN perimeter — the device designed to stop attackers is the attack surface. Organizations that cannot immediately patch should place these gateways behind strict network-layer access controls, disable internet-facing VPN portals if feasible, and initiate credential rotation for all accounts that may have authenticated through affected gateways. CISA's forensic triage requirements apply; treat any affected, internet-exposed gateway as potentially compromised prior to patching.

CVE-2026-93616 compounds the Check Point exposure by targeting the management plane — Security Management Server, Multi-Domain Security Management, Log Server, and SmartEvent. A path traversal flaw allows unauthenticated attackers to upload and execute arbitrary scripts. Management servers commonly hold policy configurations, credentials, and audit logs for an entire security estate. If you're patching the gateway (CVE-2026-85102) but not the management server, you may be restoring a clean perimeter while leaving the control plane open. Audit external access to management interfaces immediately.

CVE-2026-93952 affects Arista VeloCloud Orchestrator (on-prem deployments), where improper input validation allows a remote attacker to reach privileged internal functionality, compromising the orchestrator and all managed network data. VCO is a single pane of glass for SD-WAN policy — compromise here translates to lateral movement and policy manipulation across branch infrastructure. Organizations running on-prem VCO should confirm internet isolation of the management interface and review orchestrator audit logs for anomalous API calls dating back at least 30 days.

CVE-2026-94127 rounds out this cluster: F5 BIG-IP APM contains a heap-based buffer overflow triggered when both an access policy and an OAuth profile are configured on a virtual server. This is another unauthenticated RCE pathway on a component that sits between users and protected applications. The specific configuration dependency (OAuth + access policy) narrows exposure but does not eliminate urgency — many enterprise BIG-IP APM deployments use OAuth for SSO integration. Confirm configuration posture and apply F5's hotfix immediately.

CVE-2026-7273 (Zyxel GS1900 Series) is a stack-based buffer overflow in the switch CGI program. The attacker must be LAN-adjacent, which reduces external exposure but raises internal threat concerns — branch office switches, warehouse environments, and OT-adjacent network segments are common deployment zones. The September 24 deadline has passed; firmware updates should be applied during the next available maintenance window with no further delay.