Three management-plane zero-days dropped in 48 hours, all with confirmed active exploitation: F5 BIG-IP APM (CVE-2026-94127, CVSS 9.8), Arista VeloCloud Orchestrator (CVE-2026-93952, CVSS 10.0), and Check Point Security Management Server (CVE-2026-93616, CVSS 9.1). When the management plane is the target, the blast radius is not one device - it is every device the management plane controls. Patches are available for all three. This is a patch-today situation.

Separately, Cisco Talos published research on the first fully autonomous AI-driven command-and-control implant found in the wild, and Microsoft disrupted a phishing-as-a-service operation that compromised 12,000 accounts using device code phishing.

In the News

F5 BIG-IP APM Zero-Day RCE - CVE-2026-94127

CVE-2026-94127 is an unauthenticated remote code execution vulnerability in F5 BIG-IP Access Policy Manager’s OAuth authorization server component. CVSS 9.8. Actively exploited in the wild.

The flaw allows a remote attacker with no credentials to achieve full code execution on the BIG-IP APM instance. The attack surface is specific: only APM deployments configured to act as OAuth authorization servers are vulnerable. Standard BIG-IP LTM, ASM, or DNS deployments are not affected.

F5 released engineering hotfixes on September 22. Organizations running APM in OAuth mode should apply these immediately. As a compensating control, restrict network access to the APM management and OAuth endpoints to trusted networks only. If the APM was internet-facing before the patch, assume compromise and investigate.

What defenders should do: Apply the F5 engineering hotfix. Restrict management-plane access to the APM instance. Review access logs for unauthenticated requests to OAuth endpoints dating back at least 30 days.

Arista VeloCloud Orchestrator CVSS 10.0 - CVE-2026-93952

CVE-2026-93952 is a maximum-severity vulnerability in Arista’s VeloCloud Orchestrator - the central management platform for VeloCloud SD-WAN deployments. A remote unauthenticated attacker can access privileged internal functions when certificate-based Edge authentication is enabled.

The orchestrator is the control plane for the entire SD-WAN fabric. Compromising it gives an attacker the ability to push configuration changes to every downstream edge device, intercept traffic, or disrupt connectivity across the WAN. Active exploitation is confirmed. Only on-premises orchestrator deployments are affected - Arista patched cloud-hosted instances server-side.

The vulnerability specifically affects certificate-based Edge authentication configurations. Organizations using token-based authentication are not vulnerable to this specific flaw, but should still review their orchestrator access controls.

What defenders should do: Patch on-premises VeloCloud Orchestrators immediately. Verify whether certificate-based Edge authentication is in use. Audit orchestrator access logs for unauthorized privileged function calls. Segment the orchestrator management interface from general network traffic.

Check Point Management Server Zero-Day - CVE-2026-93616

CVE-2026-93616 allows unauthenticated arbitrary script execution on Check Point Security Management Servers. CVSS 9.1. Targeted attacks exploiting this vulnerability began on July 23 - a full two months before Check Point released hotfixes on September 22.

The Security Management Server is the centralized policy engine for Check Point firewall estates. An attacker with script execution on this server can modify firewall rules, disable security policies, create backdoor access rules, and exfiltrate the entire policy configuration. The two-month window between initial exploitation and patch availability means affected organizations need to treat this as a potential compromise, not just a vulnerability.

What defenders should do: Apply the September 22 hotfix immediately. Conduct a thorough hunt for indicators of compromise dating back to July 23. Audit all firewall policy changes made since that date. Verify the integrity of the management server’s configuration against a known-good baseline.

Cisco Talos Discovers CLOSEDQUORUM - First Autonomous AI C2 Implant

Cisco Talos published detailed research on CLOSEDQUORUM, the first reported malware that uses AI-driven decision-making at every stage of command and control without requiring a human operator. The implant autonomously decides what data to exfiltrate, when and how to move laterally, and what evasion techniques to employ - all without phoning home for instructions from a human threat actor.

Talos discovered the implant using their new CAIRN (Cognitive AI Recognition Network) hunting toolkit and traced the developer to carding forums active in 2025. The significance is not theoretical: this is a working implant found in the wild, not a proof of concept. Autonomous C2 changes the defender’s calculus because the implant does not generate the predictable behavioral patterns - beaconing intervals, consistent exfiltration timing, human-paced lateral movement - that traditional detection relies on.

What defenders should do: Review behavioral analytics capabilities in your EDR and NDR stack. Traditional signature-based and IOC-based detection will struggle with autonomous implants that vary their behavior. Invest in anomaly detection that flags unusual decision patterns rather than known-bad indicators. Monitor the Talos blog for updated IOCs and YARA rules as the research develops.

Today’s Deep Dive - Device Code Phishing and the EvilTokens Takedown

Microsoft disrupted the EvilTokens phishing-as-a-service platform on September 22, seizing 50 sites, disabling 150 domains, and enabling two arrests in the United Kingdom. The operation compromised approximately 12,000 Microsoft accounts across more than 10,000 organizations using device code phishing - a technique that abuses the OAuth 2.0 device authorization grant flow (MITRE ATT&CK: T1528 - Steal Application Access Token).

Device code phishing works by tricking a victim into entering a legitimate device authorization code on Microsoft’s real login page. The attacker initiates a device code flow, sends the code to the victim via a phishing lure, and when the victim authenticates, the attacker receives a valid access token and refresh token. The victim’s MFA completes successfully because the authentication happens on the real Microsoft login page - making this an MFA bypass technique, not a credential theft technique.

EvilTokens added AI-assisted lure generation and automated infrastructure rotation to this flow, operating at scale. The platform provided turnkey phishing campaigns that non-technical operators could deploy - lowering the barrier to entry for a technique that was previously limited to sophisticated threat actors.

The primary defense against device code phishing is restricting the device code flow itself. Organizations using Microsoft Entra ID can disable the device code flow for most users via Conditional Access policies. Only allow it for legitimate use cases - headless devices, IoT endpoints, environments without browsers. For everything else, block it. This single control eliminates the attack surface entirely.

Detection Spotlight

Detect unauthorized device code authentication attempts in Microsoft Entra ID by monitoring for the device code grant type in sign-in logs. This query surfaces device code authentications from users or applications that should not be using this flow.

index=azure sourcetype="azure:aad:signin"
| spath "properties.authenticationProtocol" output=auth_protocol
| search auth_protocol="deviceCode"
| spath "properties.userPrincipalName" output=upn
| spath "properties.appDisplayName" output=app_name
| spath "properties.status.errorCode" output=status_code
| where status_code=0
| stats count by upn, app_name, src_ip
| where NOT match(app_name, "^(Windows Sign In|Azure IoT|Company Portal)$")
| sort -count

This query filters for successful device code authentications and excludes known-legitimate applications. Any result outside your expected device code usage is a high-fidelity indicator of token theft. False positive rate is low if your organization has catalogued which applications legitimately use the device code flow.

Defender Action Items

  • Apply F5 BIG-IP APM engineering hotfix for CVE-2026-94127 - restrict OAuth endpoint access to trusted networks as a compensating control
  • Patch on-premises Arista VeloCloud Orchestrators for CVE-2026-93952 - verify certificate-based Edge authentication configuration and audit orchestrator logs
  • Apply Check Point Security Management Server hotfix for CVE-2026-93616 - hunt for IOCs back to July 23 and audit all policy changes since that date
  • Patch Zyxel GS1900 switches for CVE-2026-7273 per CISA KEV mandate (due Thursday) - investigate for data exfiltration from the Chinese threat actor campaign targeting 996 devices
  • Restrict the OAuth device code flow in Microsoft Entra ID via Conditional Access policies - allow only for legitimate headless/IoT use cases
  • Review EDR and NDR behavioral analytics capabilities against autonomous C2 patterns following the Talos CLOSEDQUORUM disclosure

Detection Queries

Check for anomalous Check Point management server script execution by reviewing SmartConsole audit logs for unauthenticated or unexpected administrative actions since July 23:

index=checkpoint sourcetype="cp:audit"
| search action="execute_script" OR action="policy_install" OR action="rule_modify"
| where isnull(administrator) OR administrator="anonymous"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, action
| where first_seen >= strptime("2026-07-23", "%Y-%m-%d")
| sort -count

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.