Three CVSS 9.8 zero-days landed in active exploitation simultaneously today - and all three target network infrastructure that sits at the perimeter. Check Point VPN, MikroTik RouterOS, and F5 BIG-IP APM each have pre-authentication remote code execution flaws being exploited in the wild right now. Meanwhile, AI agents graduated from theoretical concern to operational threat, autonomously compromising over 100 e-commerce sites and stealing 600,000 credit card numbers.

In the News

Check Point VPN Zero-Day Exploited for Pre-Auth RCE

CVE-2026-85102 is a pre-authentication remote code execution vulnerability in Check Point Security Gateway’s VPN certificate-handling logic, carrying a CVSS score of 9.8. The flaw exists in how the gateway processes X.509 certificates during the IKE negotiation phase - an attacker can send a crafted certificate that triggers a buffer overflow before any authentication occurs.

Check Point has confirmed active exploitation and released an emergency hotfix. This is the third major NGFW/VPN vendor zero-day this quarter, following Palo Alto Networks and F5. The pattern is clear: certificate-parsing and pre-authentication code paths in perimeter VPN appliances are under sustained attacker scrutiny.

What defenders should do: Apply the Check Point emergency hotfix immediately. Review whether VPN certificate-validation functions are exposed to the internet without a web application firewall or IPS in front of them. Audit VPN gateway logs for anomalous certificate-related errors dating back to at least September 1, 2026.

Source: BleepingComputer

MikroTik RouterOS SSH Chain Grants Full Admin Without Credentials

The “MikroTrick” exploit chain pairs two vulnerabilities - CVE-2026-67279 (SSH state-machine bypass, CVSS 9.8) and CVE-2026-86060 (post-auth privilege escalation) - to give attackers full administrative control of MikroTik routers without any credentials. The SSH state-machine flaw allows an unauthenticated attacker to bypass the authentication handshake entirely, and the second vulnerability escalates from the resulting limited shell to full admin.

CERT Polska has confirmed exploitation logs in the wild. MikroTik routers are pervasive in SMB and branch network deployments, often deployed outside managed firewall perimeters with no centralized firmware management. Many of these devices have not been updated in years. The attack surface is enormous and largely invisible to enterprise security teams.

What defenders should do: Identify all MikroTik devices on the network using asset discovery tools. Update RouterOS to the latest stable release immediately. If patching is not possible, restrict SSH access to management VLANs only and disable SSH on WAN-facing interfaces. Consider replacing unmanaged MikroTik devices with centrally managed SD-WAN or enterprise-grade routing platforms.

Source: The Hacker News

F5 BIG-IP APM Zero-Day - Pre-Auth RCE via OAuth Endpoint

CVE-2026-94127 is a CVSS 9.8 unauthenticated remote code execution vulnerability in F5 BIG-IP Access Policy Manager when configured as an OAuth authorization server. The flaw is in the OAuth token endpoint’s input validation - a crafted authorization request triggers arbitrary command execution on the BIG-IP appliance before any session authentication takes place.

F5 has released engineering hotfixes for affected branches but has not yet shipped GA patches. Active exploitation is confirmed. Organizations using BIG-IP APM for OAuth federation - a common deployment pattern for SSO to internal applications - should apply the hotfix immediately or restrict network access to the OAuth listener. The MITRE ATT&CK technique is T1190 - Exploit Public-Facing Application.

What defenders should do: Apply the F5 engineering hotfix. If the hotfix cannot be applied immediately, implement network-level access controls to restrict which source IPs can reach the OAuth authorization endpoint. Review BIG-IP APM logs for unusual OAuth token requests, particularly those with malformed redirect_uri or client_id parameters.

Source: The Hacker News

AI Agents Deploy Credit Card Skimmers at Scale

Threat actors have deployed open-source AI agent frameworks - likely AutoGPT-style tooling - to autonomously compromise over 100 e-commerce websites and inject payment card skimmers. Approximately 600,000 credit card numbers have been stolen. This is the first large-scale financially motivated campaign where AI agents handled the full attack lifecycle: reconnaissance, vulnerability identification, exploitation, and payload deployment, without continuous human direction.

The operational significance is speed and scale. A human attacker manually compromising 100+ sites and maintaining skimmer persistence would require weeks of effort. AI agents compressed this into days. The skimmers themselves are not novel - standard JavaScript injection into payment pages - but the delivery mechanism represents a meaningful escalation in attacker capability.

What defenders should do: E-commerce operators should implement Content Security Policy headers that restrict which scripts can execute on payment pages. Monitor for unauthorized JavaScript modifications using file integrity monitoring. Web application firewalls should be tuned to detect injection patterns associated with payment skimmers. The MITRE ATT&CK techniques involved include T1059.007 - JavaScript and T1565.002 - Transmitted Data Manipulation.

Source: BleepingComputer

Defender Action Items

  • Check Point VPN (CVE-2026-85102): Apply the emergency hotfix now. Inspect VPN logs for certificate-parsing errors since September 1. Place an IPS rule in front of the VPN listener if possible.
  • MikroTik RouterOS (CVE-2026-67279 + CVE-2026-86060): Run asset discovery to find all MikroTik devices. Update RouterOS to latest stable. Disable SSH on WAN interfaces immediately if patching is delayed.
  • F5 BIG-IP APM (CVE-2026-94127): Apply the engineering hotfix or ACL-restrict the OAuth listener. Audit OAuth token request logs for malformed parameters.
  • WordPress (CVE-2026-87902): CVSS 9.2 unauthenticated RCE via path traversal - exploited within hours of disclosure. Update all WordPress installations immediately.
  • Ubuntu kernel (CVE-2026-80521): Container escape via AF_UNIX sockets - exploit is public, no LTS patch yet. Restrict container privileges and audit seccomp profiles.
  • SolarWinds Observability (CVE-2026-28324): CVSS 9.8 pre-auth RCE - not yet exploited but patch available. Patch self-hosted deployments immediately.

Detection Queries

The following Splunk SPL query identifies potential exploitation attempts against Check Point Security Gateway VPN by looking for certificate-related error events followed by unusual process spawning on the gateway. Adapt the index and sourcetype to your Check Point log forwarding configuration.

index=fw_logs sourcetype="cp_log" OR sourcetype="checkpoint:syslog"
  (action="reject" OR action="drop" OR severity="critical")
  (certificate OR x509 OR "IKE" OR "cert_verify")
| stats count by src_ip, dst_ip, action, _time
| where count > 5
| sort - count

For MikroTik exploitation detection, monitor for SSH authentication anomalies on MikroTik management IPs. This Zeek-style detection looks for SSH connections that complete without proper authentication exchange:

event ssh_auth_attempted(c: connection, authenticated: bool, direction: string)
  {
  if ( ! authenticated && c$resp$size > 500 )
    {
    # Large response without auth = potential state-machine bypass
    NOTICE([$note=SSH::MikroTrick_Possible,
            $msg=fmt("SSH auth bypass attempt from %s to %s", c$id$orig_h, c$id$resp_h),
            $conn=c]);
    }
  }

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.