Exploited F5, Check Point, VeloCloud Flaws Hit KEV; SAP, Adobe Patched
Actively exploited critical RCE flaws in F5 BIG-IP, Check Point, and VeloCloud lead CISA KEV additions, while SAP, SolarWinds, and Adobe patch severe vulnerabilities.
A critical remote code execution vulnerability in F5 BIG-IP APM, tracked as CVE-2026-94127, is being actively exploited in the wild. This flaw allows unauthenticated attackers to execute arbitrary code by sending specially crafted traffic to BIG-IP APM access policies configured with an OAuth profile. The vulnerability's impact is severe, potentially leading to full system compromise. Exploitation has been observed targeting OAuth servers, and CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog. Patches are available from F5, and organizations are urged to apply them immediately. The Register reported, and Rapid7 and The Hacker News also covered the ongoing exploitation.
Check Point Management Servers are under active attack due to a directory traversal and file upload vulnerability, CVE-2026-93616. This critical flaw enables unauthenticated attackers to upload and execute arbitrary scripts on the management server, posing a significant risk to network security. The vulnerability has been confirmed as actively exploited, and CISA has added it to its KEV catalog, highlighting the urgency for patching. Help Net Security and Cyber Security News provided details on the exploitation and its impact.
A critical vulnerability (CVE-2026-93952) in VeloCloud Orchestrator (VCO) on-prem allows remote attackers to access privileged internal functionality and impact the VCO host, potentially leading to confidentiality and integrity compromises. This flaw is particularly concerning as it has been observed to be actively exploited, especially in certificate-based setups. CISA has added this vulnerability to its KEV catalog, emphasizing the need for immediate remediation. SecurityWeek and The Hacker News reported on the active exploitation and the associated risks.
SAP has released patches for a critical vulnerability in its Extended Passport Protocol (EPP) processing library, CVE-2026-44756. This memory safety flaw can be exploited by unauthenticated attackers through crafted network requests with malformed EPP headers, potentially leading to remote code execution. The vulnerability carries a CVSS score of 10.0, indicating its maximum severity. Several outlets, including SecurityWeek and The Hacker News, have covered the patch release and the critical nature of this vulnerability.
SolarWinds Observability Self-Hosted is affected by an unauthenticated remote code execution vulnerability, CVE-2026-28324. This flaw arises from insufficient integrity checks and can be exploited by attackers to execute arbitrary code on vulnerable systems, particularly those configured in non-default or insecure ways. SolarWinds has issued patches to address this critical issue. SecurityWeek and Cyber Security News detailed the vulnerability and the available fixes.
Adobe has addressed critical vulnerabilities in its Connect and Experience Manager (AEM) Forms products. CVE-2026-75682 in Adobe Connect is an SQL injection flaw that could lead to arbitrary code execution, while CVE-2026-75745 in AEM Forms is an incorrect authorization vulnerability also resulting in arbitrary code execution. Both vulnerabilities are critical and require immediate attention from users. SecurityWeek reported on these patches.