Arista's Perfect 10.0 Flaw Still Missing Patches for Two Trains

CISA added four actively exploited vulnerabilities in Check Point, Arista and F5 network gear to its Known Exploited Vulnerabilities catalog Sept. 22 and gave federal agencies until Friday, a three-day window, to patch them. One of the four, a maximum-severity flaw in Arista's VeloCloud Orchestrator, does not yet have a fix for two of the product's four supported release trains.

Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize a cataloged vulnerability that grants "total control of the asset post-exploitation" on the deadline CISA sets, the agency's alert said. CISA urges every organization, not only federal ones, to follow the same schedule.

Four vendors, four scores near the ceiling

CVE	Vendor / product	CVSS	Due
CVE-2026-85102	Check Point Security Gateway, Spark Firewall	9.8	Sept. 25
CVE-2026-93616	Check Point Security Management Server	9.8	Sept. 25
CVE-2026-93952	Arista VeloCloud Orchestrator	10.0	Sept. 25
CVE-2026-94127	F5 BIG-IP APM	9.8	Sept. 25

Check Point patched CVE-2026-85102, an improper certificate-validation bug in its Security Gateway and Spark Firewall VPN handling, on Sept. 9. The company said in a Sept. 22 advisory that it began observing a wave of exploitation attempts against Spark customers on Sept. 12, three days after the patch shipped. The second Check Point flaw, CVE-2026-93616, a path-traversal bug in its Security Management Server, was a zero-day: Check Point says it observed "a handful of pinpointed attacks" against it as early as July 23, two months before a fix became available as part of this week's advisory.

The flaw with a perfect score and half a patch

Arista's CVE-2026-93952, an improper input-validation bug in the on-premises VeloCloud Orchestrator, carries the maximum CVSS v3.1 score of 10.0 (9.5 under CVSS v4.0), letting a remote attacker with no login reach privileged internal functions on the orchestrator. Arista's own advisory says the bug "was discovered externally and is known to be actively exploited," and affects any VCO running certificate-based authentication to its edge devices rather than a pre-shared key. Fixes exist for the 5.2.3 and 6.4.2 release trains. For the 6.1.x and 7.0.x trains, Arista's advisory tells customers to "contact TAC for guidance," with no fixed build listed as of Sept. 22, the same day CISA started the three-day clock. Arista's interim mitigation is to restrict the orchestrator's web interface to trusted administrative networks.

F5's flaw, CVE-2026-94127, is a heap-based buffer overflow in BIG-IP's Access Policy Manager that triggers when a virtual server has both an access policy and an OAuth profile configured, letting an unauthenticated attacker execute code inside the Traffic Management Microkernel that handles live traffic. Unlike Arista's, F5 has released hotfixes for the bug and also offers an emergency iRule, a small piece of traffic-handling logic, for operators who cannot install the hotfix before Friday.

What none of the three vendors has said

None of the three companies has disclosed how many customers were compromised before their respective fixes shipped, and Arista has not given a date for the 6.1.x and 7.0.x fixes it still owes. That silence over scale is the same gap that showed up in CISA's Linux kernel addition earlier this month, where the deadline arrived well ahead of any public count of affected systems, and in the Siemens PLC advisories CISA has issued through the year: a score and a deadline, with the actual damage left to outside researchers to estimate.

Until Arista ships builds for the 6.1.x and 7.0.x trains, the only guidance the company offers those customers is the same network-restriction advice CISA gives anyone who cannot meet Friday's deadline at all.