Vulnerability Management

Eight exploited CVEs hit Linux, F5, Check Point, Arista and Zyxel

A single day's CVE roundup lists eight vulnerabilities as confirmed exploited, and most sit in infrastructure that security teams rely on for control and visibility. Here is how to triage them.

PyramidLedger Research24 September 20263 min read

The 24 September 2026 CVE Brief lists eight CVEs flagged as CISA Known Exploited Vulnerabilities across the Linux kernel, F5 BIG-IP, Check Point Quantum, Arista VeloCloud Orchestrator and a Zyxel switch.
Three of the eight are Linux kernel bugs, and three sit in security or network-management products (F5 BIG-IP APM and two Check Point Quantum components).
Known-exploited status should outrank raw severity scores when you set patch order.
Treat management planes and edge appliances as the first exposure to check, then confirm the fixed versions against each vendor's advisory.

The CVE Brief for 24 September 2026 lists eight CVEs that it marks as present in CISA's Known Exploited Vulnerabilities (KEV) catalogue. The list is not a single campaign or a single vendor. It is a cross-section of the gear that sits between the internet and everything else: kernels, application delivery controllers, firewall management, SD-WAN orchestration and access switches.

What the brief lists

Linux kernel: CVE-2025-39964 (race condition in the crypto subsystem), CVE-2026-53266 (memory corruption in the netfilter bridge code) and CVE-2025-39682 (TLS zero-length record handling).
F5 BIG-IP: CVE-2026-94127, a heap-based buffer overflow in APM.
Check Point Quantum: CVE-2026-93616 (directory traversal and file upload in Security Management) and CVE-2026-85102 (a certificate trust validation flaw in Security Gateway).
Arista VeloCloud Orchestrator On-Prem: CVE-2026-93952, an input validation bypass.
Zyxel GS1900-48HPv2: CVE-2026-7273, a stack-based buffer overflow.

The brief points to vendor advisories for fixes rather than naming fixed versions, so we are not quoting any here. Pull the affected and fixed version ranges from each vendor before you act.

Why this mix matters

Exploited-in-the-wild status changes the maths of patching. A vulnerability with a high score and no known exploitation can wait for a change window. One that is confirmed exploited cannot, because someone is already using it against real systems.

The affected products also share a property: they are trusted control points. A compromised management server such as Check Point's Security Management can expose policy and configuration for many gateways. An orchestrator such as VeloCloud Orchestrator can do the same for an SD-WAN estate. A compromised BIG-IP APM instance sits directly in the authentication path. That is our reading of the exposure, not something the brief states, but it is why these entries deserve priority over many endpoint-level bugs.

A triage order that works

1Inventory first. Identify which of these products you actually run, including on-prem orchestrators and forgotten branch switches, and record versions.
2Check exposure. Determine whether management interfaces and APM portals are reachable from the internet or from broad internal networks. Restricting access is a sensible interim control while you schedule patching.
3Patch by exploitation status. Start with the KEV-listed items on internet-facing or management-plane assets, then move to internal ones.
4Hunt, don't just patch. For anything exposed while vulnerable, review logs and configuration for unexpected changes, uploaded files or new accounts. A patch does not remove an implant that was already installed.
5Cover the kernel separately. Kernel flaws depend on the distribution and version you run, so map each CVE to your vendor's kernel package rather than the upstream version number.

Caveats on the source

CVE Brief is an aggregator. Before you rely on an entry for a change ticket, confirm it against the CISA KEV catalogue and the vendor's own advisory. We have deliberately left out severity scores here because the aggregated listing is not a substitute for the vendor or NVD score, and the KEV flag is the signal that matters for prioritisation.

Frequently Asked Questions

What does 'Known Exploited Vulnerability' mean?

It means the vulnerability appears in CISA's KEV catalogue, which tracks flaws with evidence of exploitation in the wild. It is a stronger prioritisation signal than a severity score alone, because it shows attackers are already using the flaw.

Which products were listed as exploited on 24 September 2026?

According to the CVE Brief, the eight CVEs affect the Linux kernel (three CVEs), F5 BIG-IP APM, Check Point Quantum Security Management and Security Gateway, Arista VeloCloud Orchestrator On-Prem, and the Zyxel GS1900-48HPv2 switch.

If I cannot patch immediately, what should I do?

Restrict network access to management interfaces and authentication portals, review logs for signs of prior compromise, and follow any vendor-published mitigation. Then schedule the patch against the vendor's fixed-version guidance.

Sources

1CVE Brief - September 24, 2026 — CVE Brief
2Known Exploited Vulnerabilities Catalog — CISA