Check Point and F5 patch actively exploited vulnerabilities

Check Point released emergency fixes for a critical Management Server flaw (CVE-2026-93616) exploited since July 23, 2026, and confirmed attacks on Spark firewalls via CVE-2026-85102. CISA added both flaws, plus bugs in Arista VeloCloud and F5 BIG-IP APM, to its Known Exploited Vulnerabilities catalog and gave US federal agencies until September 25 to patch.

• CVE-2026-93616 is a path traversal in Management Server exploited since July 23
• CVE-2026-85102 allows auth bypass and RCE in Spark firewalls; attacks began September 12
• CISA orders US federal agencies to fix all four flaws by September 25
• F5 BIG-IP APM is vulnerable when configured as an OAuth Authorization Server