Weekly AppSec Threat Digest — Sep 18–25, 2026

This week belongs to the edge. The products organizations deploy precisely because they are supposed to make the perimeter safer — F5 load balancers, Arista's SD-WAN control plane, Check Point's management and VPN infrastructure — are the ones carrying the week's most urgent, actively exploited critical vulnerabilities. When the security infrastructure itself becomes the initial-access vector, patch queues stop being a scheduling conversation and become an incident-response clock.

The numbers tell the story: a CVSS 9.8 unauthenticated remote-code-execution zero-day in F5 BIG-IP Access Policy Manager already in CISA's Known Exploited Vulnerabilities catalog; a perfect-score CVSS 10.0 flaw in Arista VeloCloud Orchestrator granting privileged access to an SD-WAN control plane that attackers have been observed hitting; and a Check Point pre-authentication management-server vulnerability disclosed only because targeted exploitation was already underway — alongside a material escalation of the previously disclosed Check Point VPN flaw, which CISA moved into KEV on September 22. For anyone running an exposed management interface, the message from this week's advisories is unambiguous: authentication in front of an attack surface is not the same as the attack surface not existing.

Away from the appliances, Cloudflare shipped the week's best disclosure — a meticulously documented postmortem of a cross-tenant data-leakage bug in Cloudflare Containers that reads like a masterclass in storage-layer isolation failures — while watchTowr's technical teardown of the F5 flaw doubles as a field manual for testing parser code that handles security-critical headers. And a $6,500 OpenAI bounty for an AI-assisted exploit chain offered an early, concrete data point on how language models change the economics of multi-step attack development.

What to do first: September 18–25 action matrix

High-severity CVEs, in context

F5 BIG-IP APM — CVE-2026-94127: the zero-day in the OAuth path

A heap-based buffer overflow in BIG-IP Access Policy Manager can give an unauthenticated remote attacker code execution when BIG-IP is configured as an OAuth authorization server — a deployment pattern common precisely in the enterprises that put BIG-IP in front of everything. Rapid7's assessment notes exploitation was already occurring before disclosure, and CISA has added the CVE to the KEV catalog. The exploitation prerequisite (the OAuth AS configuration) narrows the vulnerable population but does nothing to soften the finding for those inside it: this is an unauthenticated memory-corruption RCE on a tier-1 network appliance, with in-the-wild use.

Unauthenticated Request

Crafted Authorization Header

↓→

OAuth AS Path

BIG-IP APM Config

↓→

Heap Overflow

CVE-2026-94127

↓→

Remote Code Exec

Appliance Takeover

Remediation posture: apply F5's fixed releases or hotfix immediately — and if the vulnerable OAuth configuration was reachable from the internet, patching is not the end of the work. Treat the device as potentially compromised: pull logs, check for persistence, and rotate every credential that transited the box. A KEV-listed unauthenticated RCE on an internet-facing appliance is an assume-breach event. Rapid7's technical assessment carries the affected-version and fixed-version matrices.

Arista VeloCloud Orchestrator — CVE-2026-93952: a 10.0 aimed at the control plane

An unauthenticated input-validation flaw in the on-premises VeloCloud Orchestrator can yield highly privileged access to the SD-WAN control plane — the system that decides how every managed edge routes its traffic. Attacks have been observed against certificate-authenticated configurations, a detail that matters: it means the mitigating assumption many operators make (“we require client certificates on the orchestrator”) did not hold. CISA added the vulnerability to KEV on September 22.

Unauthenticated Input

VCO Management Interface

↓→

Validation Flaw

CVE-2026-93952

↓→

Privileged Access

SD-WAN Control Plane

↓→

Fleet-Wide Impact

Managed Edge Manipulation

Remediation posture: upgrade affected VCO branches to Arista's fixed builds now; where a fix is not yet available for your branch, follow the vendor's interim mitigations and restrict management-plane exposure (network-level allow-lists, remove the orchestrator from any internet-facing address space). An orchestrator compromise is not a single-box problem — it is a every-edge-owns-its-policy problem. Rescana's advisory tracks the KEV addition and affected branches.

Check Point Management Server — CVE-2026-93616: the policy brain, pre-auth

Check Point disclosed a pre-authentication vulnerability affecting Security Management Servers after detecting targeted exploitation in the wild. Successful attacks can execute arbitrary scripts on the management server — a uniquely ugly position, because the management server is the authority for security policy across every gateway it manages. Code execution there is not one box lost; it is the ability to re-write what “secure” means for the whole estate.

Remediation posture: install the emergency Jumbo Hotfix or the available vendor fix, then investigate the management infrastructure for compromise — policy pushes, administrator accounts, and script execution history all belong in scope. Because the disclosure exists specifically because targeted exploitation was observed, applying the patch without a compromise check answers the wrong question. The Check Point advisory is the primary source for versions and hotfix accumulation.

Check Point VPN gateways — CVE-2026-85102: the deadline passed

The pre-authentication VPN flaw disclosed earlier this month escalated materially this week: CISA added it to KEV on September 22 following confirmed exploitation. For the population of organizations that treated the September patch cycle as a suggestion, the situation has changed in kind, not degree — mass scanning and opportunistic exploitation are the default state for KEV-listed pre-auth VPN bugs, and internet-exposed gateways should be presumed targeted. Patch, then rotate credentials and review sessions that predate the patch. Rescana's KEV tracking covers both Check Point entries.

Next.js next/og — CVE-2026-94545: SVG in, RCE out

A newly disclosed vulnerability in the Node.js ImageResponse implementation used by next/og shows how a seemingly cosmetic feature — server-side social-card generation — becomes critical: specially crafted SVG content can lead to remote code execution in vulnerable server-side image-generation workflows. Next.js is routinely deployed directly behind internet-facing serverless and API infrastructure, where the input to those generators is often user- or attacker-influenced (render a card for user-supplied text, an og-image for an arbitrary URL, a preview for a submitted link).

Attacker-Supplied Content

SVG Markup

↓→

ImageResponse

next/og Rendering

↓→

SVG Processing Flaw

CVE-2026-94545

↓→

Remote Code Exec

Server-Side

Remediation posture: update affected Next.js releases, and until patched treat any flow that feeds attacker-controllable image or SVG markup into server-side generation as exposed. The general lesson outlives this CVE: SVG is a document format with scripting and external-reference semantics, not an image — anything that parses it server-side is doing code-adjacent work, not image work.

Web application security research

Cloudflare Containers: cross-tenant data leakage in the storage layer

Cloudflare published an unusually good postmortem on September 24 covering a vulnerability reported through its bug bounty program — worth reading in full by anyone whose product runs untrusted workloads on shared infrastructure. Cloudflare Containers used Linux thin-provisioning storage (dm-thin) with skip_block_zeroing enabled. When physical blocks were recycled between tenants, a new container could perform a small, aligned write — then read back the rest of the 64 KiB block and recover residual data belonging to previous tenants.

The researchers — who observed foreign residual material on 18 of 24 tested placements and 20 of 22 underlying nodes — recovered directory structures, database pages, and structurally complete SQLite databases. Two boundaries are worth internalizing from their results. First, the attacker could not select a particular victim: this is a “whichever tenant came before” leak, which limits targeting but not impact. Second, Cloudflare found no evidence of malicious exploitation, the fleet has been remediated, and customers need take no action — a clean, well-scoped disclosure.

The Authorization header as an attack surface

watchTowr's technical analysis of CVE-2026-94127 walks through how an unauthenticated request reaches the vulnerable BIG-IP path through the Authorization header — and doubles as one of the week's most useful methodological reads. Headers like Authorization sit at the seam between your front-line parser and your authentication logic, which makes them uniquely dangerous: they are parsed before the request is trusted, often by C code with a long lineage, and every parser in the chain may have a slightly different opinion about what constitutes a valid header.

Testing takeaway: parsers handling security-critical headers deserve aggressive malformed-input testing — overlong values, unexpected encodings, duplicate headers, malformed whitespace, embedded control characters — not only semantic auth testing with well-formed requests. Most authorization testing starts after the parser; most memory bugs live inside it.

Bug bounty highlights

Cloudflare Containers — the week's strongest disclosure, end to end

Beyond the technical content, the Cloudflare disclosure is a model of process. Oren Yomtov of Accomplish reported the issue on September 4; Cloudflare opened an incident roughly three hours later, deployed the initial fleet mitigation within hours, completed historical snapshot cleanup by September 19, awarded a bounty on September 14, and published the full technical postmortem on September 24 — twenty days from report to public write-up, with no information gap for customers in between.

For bounty hunters the methodology is the story: don't just attempt to escape the sandbox — test what persists after another tenant disappears. Data-leakage classes that only manifest across tenant lifecycles (write-then-read, allocate-recycle-recover) are invisible to single-session testing, and shared-infrastructure targets are full of them.

The OpenAI chain — $6,500 for an AI-accelerated exploit path

Hacktron researchers disclosed work in which Claude assisted them in building an exploit chain involving an image-processing vulnerability and OpenAI's Discourse/community infrastructure — reportedly progressing to compromise of an employee account and access to internal resources before responsible disclosure, for a $6,500 bounty.

The useful takeaway is not the headline (“AI hacked OpenAI”). It is that AI-assisted exploit development can substantially accelerate multi-step chaining once a researcher has already identified promising primitives — the grinding, mechanical work of turning two weak links into a working chain is where the assistance compounds. Defensively, that means the marginal cost of sophisticated chains is falling, and single-primitive fixes that “wouldn't matter alone” matter more, not less.

This week's priority

F5 BIG-IP APM → Arista VeloCloud → Check Point Management/VPN → vulnerable Next.js deployments. In that order, because that is the order of exposure: internet-facing OAuth paths first, SD-WAN control planes second, security-management brains third, and the application framework your product team ships with fourth.

The bigger trend is worth naming plainly: security appliances and infrastructure control planes continue to be disproportionately represented among exploited critical vulnerabilities. These products share a pathology — high privilege, wide blast radius, legacy parser surface, and deployment patterns that concentrate risk in a small number of hosts that everyone can find. An exposed management interface should now be treated as a high-value attack surface regardless of whether authentication sits in front of it, and “the management plane is not internet-facing” belongs on the same shelf as other famous last words. Verify it.