CVE-2026-93616, CVE-2026-85102, CVE-2026-93952, CVE-2026-94127: Check Point & F5 BIG-IP — Remote Code Execution Exposed (July 2026)

CVE-2026-93616, CVE-2026-85102, CVE-2026-93952, CVE-2026-94127 — Check Point & F5 BIG-IP

Multiple critical zero-day vulnerabilities (CVE-2026-93616, CVE-2026-85102, CVE-2026-93952, CVE-2026-94127) have been confirmed as actively exploited since July 23, 2026. These flaws allow pre-authentication remote code execution on Check Point Management Servers, Spark Firewalls, and F5 BIG-IP APM instances. Severity is critical; exploitation has resulted in full compromise of affected systems.

Attack Vector

Attackers leveraged these vulnerabilities to gain initial access via certificate-based Mobile Access logins, bypassing authentication controls. Post-compromise, adversaries conducted internal port and service scanning through the Mobile Access portal, using anonymization infrastructure such as VPNs and proxies to mask activity. Indicators include anomalous certificate logins and unusual internal network scans originating from the affected appliances.

Who Is at Risk

Affected products include Check Point Management Servers, Spark Firewall devices, and F5 BIG-IP APM (Access Policy Manager) instances. Both Check Point Software Technologies and F5 Networks customers are impacted globally. Organizations with exposed management interfaces or unpatched appliances are at highest risk.

Patch & Mitigate

• Patch: Apply vendor emergency patches for all affected Check Point and F5 BIG-IP APM systems immediately. Refer to vendor advisories for exact versions.
• Workaround: Restrict management interface access to trusted networks only. Disable Mobile Access if not required.
• Detect: Review logs for anomalous certificate-based logins, unexpected Mobile Access activity, and internal scanning from appliance IPs. Monitor for connections via anonymization services.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit pre-authentication flaws to gain entry.
• TA0002 — Execution: Remote code execution is achieved on management servers and firewalls.
• TA0005 — Defense Evasion: Use of VPNs/proxies masks attacker origin and activity.

Source: https://www.helpnetsecurity.com/2026/09/23/check-point-f5-big-ip-apm-zero-days-targeted/