Your Network Access Gateway Is Being Exploited Right Now. Here's What the F5 BIG-IP Zero-Day Means for Your Business.

On September 22, 2026, CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities catalog — the federal government's official list of software flaws with confirmed, active exploitation in the wild. The vulnerability: a heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM) that allows an unauthenticated attacker to execute arbitrary code remotely, with no credentials required. CVSS score: 9.8 out of 10.

If your organization uses F5 BIG-IP as a network access gateway — and many do — this is not a theoretical risk. Attackers are already exploiting it.

What Is F5 BIG-IP APM and Why Does It Matter?

F5 BIG-IP is used by thousands of enterprises, government agencies, financial institutions, and healthcare organizations worldwide to manage network access, VPN connectivity, and application delivery. The APM (Access Policy Manager) module is specifically the piece that controls who gets in — it handles authentication, access policy enforcement, and increasingly, OAuth-based authorization for modern applications.

In plain terms: it's the front door to your network. And right now, that front door has a lock that attackers know how to pick.

The vulnerability is triggered when BIG-IP APM is configured as an OAuth Authorization Server — a common deployment pattern as organizations modernize their application access controls. An attacker sends specially crafted network traffic to the vulnerable system and can achieve full remote code execution without ever needing a username or password.

The Same-Day Story: Check Point and Arista Too

The F5 zero-day didn't arrive alone. On the same day CISA added CVE-2026-94127 to KEV, it also added three others:

- CVE-2026-93616 — a pre-authentication path traversal in Check Point Security Management Server, exploited as far back as July 23, 2026. Attackers can upload and execute arbitrary scripts on the management server. - CVE-2026-85102 — an authentication bypass and RCE flaw in Check Point Security Gateway (Quantum Spark). Active exploitation attempts observed globally starting September 12. - CVE-2026-93952 — an improper input validation flaw in Arista VeloCloud Orchestrator, the central management platform for VeloCloud SD-WAN.

Four network security products. Four zero-days. One day. All actively exploited.

This is not a coincidence. It's a pattern.

Why Attackers Go After Network Security Infrastructure

I've spent 25 years watching how attackers think. They go after what gives them the most leverage with the least resistance. And right now, network security infrastructure — firewalls, VPN gateways, network access controllers — checks every box:

Maximum access, minimum friction. These devices sit at the boundary of your network. Compromise one and an attacker often has visibility into everything behind it — without needing to move laterally through dozens of systems.

Trusted by design. Traffic from a BIG-IP APM system or a Check Point gateway looks legitimate by definition. It's supposed to manage network access. Security monitoring tools frequently have blind spots here, or worse, implicitly trust management traffic.

Slow to patch. Network infrastructure touches everything. Changes require change management, maintenance windows, testing, and sign-off. Many organizations are running patch cycles measured in weeks or months on these devices — while attackers move in hours.

Exposure is structural. These devices must be reachable from the internet to do their job. You can't hide your VPN gateway behind another firewall.

The OAuth Angle Is Particularly Concerning

The F5 vulnerability is specifically triggered in OAuth Authorization Server configurations. This is worth pausing on.

OAuth is the protocol behind modern application authentication — it's how applications delegate access permissions to each other, how single sign-on works, and how your identity platform grants tokens that prove who you are across cloud applications. When your BIG-IP APM acts as an OAuth Authorization Server, it's not just controlling network access — it's minting the tokens that authenticate users across your entire application ecosystem.

An attacker with code execution on that system doesn't just get network access. They potentially have the ability to observe, manipulate, or forge the identity tokens that govern access across your cloud and on-premises applications. The blast radius is significant.

Three Questions Every Business Leader Should Be Asking

You don't need to be a network engineer to ask the right questions. Here are three that matter:

1. Do we run F5 BIG-IP APM, Check Point, or Arista VeloCloud — and are they patched?

This is the first question to put to your IT team or managed service provider today. Not "are we planning to patch" — "are we patched." F5 released engineering hotfixes for BIG-IP APM 21.1.0, 17.5.x, and 17.1.x. CISA's federal deadline is September 25, 2026 — two days from now. If your organization hasn't patched by the time you read this, that's the conversation to have.

2. Should we assume we're already compromised?

CVE-2026-93616 in Check Point was exploited as far back as July 23 — two months before it was publicly attributed. The F5 zero-day was added to KEV the same day F5 published its advisory, which means the exploitation timeline may extend further back than the public record shows. For any system that has been running a vulnerable version of these products while internet-exposed, the right default posture is "assume compromise, prove otherwise" — not "assume clean until proven otherwise."

That means reviewing logs from the affected systems for the past 60-90 days, looking for anomalous access patterns, unexpected outbound connections, or configuration changes you didn't make. If you don't have the logging to do that, that's a separate conversation to have with your security team.

3. How quickly can we respond to a CVSS 9.8 actively exploited flaw on internet-facing infrastructure?

The Verizon DBIR consistently shows that median enterprise patch cycles run 44 days. CISA's federal deadline for this flaw is 3 days. The gap between those two numbers is where breaches happen.

For internet-facing network security infrastructure with actively exploited vulnerabilities, your response time needs to be measured in hours, not weeks. Do you have a defined SLA for that? Who owns the decision? Who can authorize emergency maintenance?

If you're not sure, that's the gap to close.

What You Should Do Right Now

If you run F5 BIG-IP APM, Check Point Security Management Server, Check Point Quantum Spark Gateway, or Arista VeloCloud Orchestrator:

- Inventory your versions immediately - Apply available hotfixes and patches — F5, Check Point, and Arista have all released fixes - Review logs from July 2026 forward for indicators of compromise - Treat any anomalous activity as a potential active incident

If you're not sure whether you run these products, or you're not sure who in your organization owns them, that's the first answer to get.

Network security infrastructure is not a set-it-and-forget-it layer. In 2026, it's one of the most actively targeted attack surfaces in enterprise environments. Treat it accordingly.

The Bottom Line

Four network security zero-days in one day. All actively exploited. All added to CISA's KEV catalog with a 3-day federal patch deadline. The pattern is clear: attackers are systematically targeting the infrastructure your business uses to control access — firewalls, VPN gateways, network access managers — because that's where the leverage is.

The organizations that come through this well are the ones that treat network infrastructure patching with the same urgency as a fire alarm, not the same urgency as a quarterly review. If you're not sure your organization is in that category, TrustPoint Cyber can help you find out.