Another week, another batch of “critical” bugs that somehow made it out the door wearing a fake mustache and calling themselves features. If you manage edge gear for a living, maybe don’t make plans for a long lunch.
This Week's Hall of Shame: Top CVEs
CVE-2026-93616 — Check Point forgot what “path” means
The Gist: Check Point Management Server is dealing with a CVSS 9.8 unauthenticated directory traversal and file upload bug that can lead straight to arbitrary script execution. It’s being exploited in the wild, and yes, there’s public proof-of-concept code too, because apparently attackers enjoy convenience as much as the rest of us.
Why It Should Keep You Up at Night: This is pre-auth on a management server, which is roughly the cybersecurity equivalent of leaving your house keys under a doormat labeled “house keys.” If an attacker lands here, they’re not just poking at one box — they’re staring at the beating administrative heart of your environment.
Your Playbook:
- Patch Check Point Management Server immediately using the vendor’s advisory guidance and emergency fixes.
- Hunt for unexpected uploaded scripts, suspicious web-access logs, and any signs of unauthorized file write activity on the management host.
Sources: Rapid Risk Radar | CVE Organization | VulnCheck KEV | Bleeping Computer
CVE-2026-94127 — OAuth server, meet unauthenticated RCE
The Gist: F5 BIG-IP APM has a CVSS 9.8 remote code execution flaw that hits when APM is configured as an OAuth Authorization Server on a virtual server. It’s unauthenticated, actively exploited, and affects the data plane, including systems running in Appliance mode.
Why It Should Keep You Up at Night: If your deployment uses the vulnerable OAuth authorization server setup, an attacker can skip the whole “credentials” formality and go straight to code execution. This is the sort of issue that turns perimeter infrastructure into an involuntary guest star in someone else’s intrusion playbook.
Your Playbook:
- Apply F5’s patched versions or hotfixes immediately, and prioritize any BIG-IP instances configured with APM as an OAuth Authorization Server.
- If patching is delayed, identify and restrict or disable affected OAuth authorization server profiles where operationally possible, and closely monitor for anomalous traffic hitting APM virtual servers.
Sources: Rapid Risk Radar | CVE Organization | CISA Known Exploited | VulnCheck KEV
CVE-2026-93952 — Orchestrator, but for chaos
The Gist: Arista Networks’ VeloCloud Orchestrator on-prem is facing a CVSS 10.0 input validation flaw that may let a remote attacker access privileged internal functionality and impact the VCO host. It’s already being exploited in the wild; hosted and dedicated versions were impacted too, but those have already been patched.
Why It Should Keep You Up at Night: An orchestrator is supposed to manage your environment, not audition for the role of attacker beachhead. If someone compromises this box, they can potentially tamper with the confidentiality, integrity, and availability of both the orchestrator and the data it manages — which is a very fancy way of saying “everything gets bad all at once.”
Your Playbook:
- Patch on-prem VeloCloud Orchestrator instances immediately per Arista’s advisory, and verify that hosted or dedicated environments are on remediated versions.
- Review administrative access logs, internal function calls, and system changes for signs of unauthorized privileged activity originating from remote sources.
Sources: Rapid Risk Radar | CVE Organization | The Hacker News | VulnCheck KEV
Industry Intel: What Else is On Fire This Week
-
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers — Because one firewall-adjacent emergency per week would apparently be too merciful. Read more
-
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware — Just a nice reminder that browser-to-OS exploit chains are still very much a thing, in case anyone was feeling optimistic for five minutes. Read more
-
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input — SVGs continue their long tradition of being “just images” in the same way a trapdoor is “just flooring.” Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.