Serial Number: AV26-902
Date: September 9, 2026
Updated: September 22, 2026

As of September 9, 2026, Check Point is affected by vulnerabilities in the following products:

• Security Gateway
  • Multiple versions
• Check Point Spark Firewall using Site to Site VPN or Remote Access VPN
  • Multiple versions
• Security Management Server
  • Multiple versions
• Check Point Spark Firewall
  • Multiple versions

Update 1

Check Point has reported that CVE-2026-85102 and CVE-2026-93616 are being exploited in the wild.

Update 2

On September 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) CVE-2026-85102 and CVE-2026-93616 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CVE-2026-85102 - Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN
• CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution
• Check Point Security
• Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616
• CISA KEV: CVE-2026-85102
• CISA KEV: CVE-2026-93616

Serial number:AV26-949
Date:September 22, 2026

As of September 22, 2026, F5 is affected by a vulnerability in the following product:

• BIG-IP APM
  • Versions 21.1.0 prior to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
  • Versions 17.5.0 prior to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
  • Versions 17.1.0 prior to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG

F5 has reported that CVE-2026-94127 is being exploited in the wild.

Update 1
On September 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-94127 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• K000162605: BIG-IP APM vulnerability CVE-2026-94127
• 2026 security notifications
• CISA KEV: CVE-2026-94127

Serial number:AV26-947
Date:September 22, 2026

As of September 22, 2026, Arista Networks is affected by a vulnerability in the following product:

• VeloCloud Orchestrator (VCO) On-Prem
  • Versions 5.2.0 to 5.2.3.15
  • Versions 6.1.0 to 6.1.3.7
  • Versions 6.4.0 to 6.4.2.7
  • Versions 7.0.0 to 7.0.0.2

Update 1

On September 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-93952 to their Known Exploited Vulnerabilities (KEV) Database.

Open-source reporting indicates that CVE-2026-93952 is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security Advisory 0183
• Arista Networks Advisories & Notices
• CISA KEV: CVE-2026-93952

Number: AL26-022
Date: September 22, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Canadian Centre for Cyber Security (Cyber Centre) is aware of a critical vulnerability affecting F5 BIG IP Access Policy Manager (APM)^Footnote1.

In response to the vendor advisory released on September 22, 2026, the Cyber Centre released AV26-949 on September 22, 2026^Footnote2.

Tracked as CVE-2026-94127^Footnote3, this vulnerability is a Heap-based Buffer Overflow (CWE-122)^Footnote4 and it affects F5 BIG-IP systems where an APM access policy and an OAuth profile are configured on the same virtual server. Under these conditions, specially crafted malicious traffic may allow an unauthenticated attacker to execute arbitrary code on the affected device, potentially resulting in remote code execution and full system compromise.

F5 has indicated that CVE-2026-94127 is being exploited in the wild.

Suggested actions

The Cyber Centre strongly recommends that organizations running affected F5 BIG‑IP APM deployments upgrade to the following vendor-supported fixed hotfix releases:

The Cyber Centre also recommends organizations to:

• Identify vulnerable BIG IP systems that have both an APM access policy and an OAuth profile configured on a virtual server.
• Apply the vendor-provided iRule (contact F5 Support to obtain the iRule)^Footnote1.
• Review access logs for indicators of compromise (IoC), particularly OAuth authentication failures especially in rapid succession or large volume^Footnote1. Also review administrative accounts, access policies for any signs of suspicious activity.
• Upgrade to a vendor-supported fixed software version as soon as possible.
• Ensure management interfaces are restricted to trusted administrative networks.
• Follow F5 guidance for vulnerability remediation and validation following patch deployment.

Note: Organizations operating Common Criteria^Footnote5 evaluated configurations should review F5's advisory^Footnote1 and apply the recommended updates in accordance with their change management and certification requirements.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions^Footnote6 with an emphasis on the following topics:

• Consolidating, monitoring, and defending Internet gateways
• Patch operating systems and applications
• Harden operating systems and applications
• Isolate web-facing applications

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

References

Serial Number:AV26-948
Date:September 22, 2026

As of September 22, 2026, Erlang is affected by vulnerabilities in the following product:

• OTP
  • 17.0 Prior to 27.3.4.18
  • 21b8a1b Prior to afec515, 98c66c8 and fd1d9d0
  • 22.2 Prior to 27.3.4.18, 28.5.0.7 and 29.1.1
  • 4.1.1 Prior to 5.2.11.13, 5.5.2.6 and 6.0.6
  • 9.5 Prior to 11.2.12.13, 11.6.0.6 and 11.7.7
  • Versions Prior to 84adefa

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CVE-2026-65634
• CVE-2026-89422
• Security Advisories · erlang/otp · GitHub

Serial number:AV26-503
Date: May 25, 2026
Updated: September 21, 2026

On May 24, 2026, Roundcube published security advisories to address vulnerabilities in the following product: 

• Roundcube Webmail – versions prior to 1.6.16
• Roundcube Webmail – versions prior to 1.7.1

Update 1

Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Roundcube Webmail 1.6.16
• Roundcube Webmail 1.71
• Roundcube Open Source Webmail Software