Grade One Press

Technology reporting you can check

News · Security & privacy

Critical flaws in F5 and Check Point security products were exploited on the day they were disclosed

Both let an unauthenticated attacker run code: one in F5's BIG-IP access gateway when it acts as an OAuth server, the other in Check Point's management server.

Catching up: the original came out on . This story was published later, when the site opened.

Grade One Newsroom · 1 min read

Sources: 3 · top grade 1How evidence is graded

Critical F5 BIG-IP and Check Point flaws were exploited as soon as they were disclosed

Grade 1 · Primary

Source: US Cybersecurity and Infrastructure Security Agency (CISA)

What changed
CISA listed critical flaws in F5 BIG-IP APM and Check Point Management Server as exploited on 22 September, the day both were published.
Who it affects
Organisations running F5 BIG-IP APM set up as an OAuth authorisation server, and those running Check Point Management Server.
What it does not tell you
How many systems are exposed or were breached, and by whom. Neither CISA nor the vulnerability records say.

The full story Check the source

The US Cybersecurity and Infrastructure Security Agency listed critical flaws in F5 and Check Point security products as exploited on 22 September, the same day the flaws were published [1][2][3].

Federal agencies were given until 25 September to deal with them [1].

The F5 flaw, CVE-2026-94127, lets an unauthenticated attacker run code on BIG-IP Access Policy Manager through specially crafted traffic. It is scored 9.8 out of 10 [2].

The Check Point flaw, CVE-2026-93616, lets an unauthenticated attacker upload and run scripts on Check Point Management Server. It is also scored 9.8 [3].

What it covers

For F5, only BIG-IP APM set up as an OAuth authorisation server, with an access policy and an OAuth profile on a virtual server. Deployments using APM only as an OAuth client or resource server are not affected [2].

For Check Point, its Management Server. CISA also listed a second Check Point flaw, in certificate validation, the same day [1][3].

What it does not tell you

How many systems are exposed, or who is exploiting the flaws. The sources give no numbers or names [1][2][3].

Sources and their grades

  1. US Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, entries CVE-2026-94127, CVE-2026-93616 and CVE-2026-85102. Read 29 September 2026. Grade 1 · Primary Added 22 September 2026, due 25 September for US federal agencies.
  2. US National Vulnerability Database (NIST), CVE-2026-94127. Read 29 September 2026. Grade 1 · Primary Published 22 September 2026. The description and the 9.8 score are F5's, as the reporting organisation.
  3. US National Vulnerability Database (NIST), CVE-2026-93616. Read 29 September 2026. Grade 1 · Primary Published 22 September 2026. The description and the 9.8 score are Check Point's.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under Network security Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all