# Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances

DevFeed: [Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances](<https://devfeed.tech/articles/attackers-hit-check-point-management-servers-and-spark-firewalls-f5-big-ip-apm-instances-58613.md>)

Original publisher: [Read original article](<https://www.helpnetsecurity.com/2026/09/23/check-point-f5-big-ip-apm-zero-days-targeted/>)

Author: Zeljka Zorz

Published: 2026-09-23T10:22:52Z

Content type: news

Language: en

Sources: [Help Net Security](<https://devfeed.tech/sources/help-net-security.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [patches](<https://devfeed.tech/topics/patches.md>), [gateway](<https://devfeed.tech/topics/gateway.md>), [Server](<https://devfeed.tech/topics/server.md>), [Application Performance Management (APM)](<https://devfeed.tech/topics/apm.md>)

Tags: [0-day](<https://devfeed.tech/tags/0-day.md>), [access-management](<https://devfeed.tech/tags/access-management.md>), [arista-networks](<https://devfeed.tech/tags/arista-networks.md>), [authentication-bypass](<https://devfeed.tech/tags/authentication-bypass.md>), [big-ip-apm](<https://devfeed.tech/tags/big-ip-apm.md>), [check-point](<https://devfeed.tech/tags/check-point.md>), [cisa](<https://devfeed.tech/tags/cisa.md>), [cve](<https://devfeed.tech/tags/cve.md>), [don-t-miss](<https://devfeed.tech/tags/don-t-miss.md>), [f5](<https://devfeed.tech/tags/f5.md>), [f5-networks](<https://devfeed.tech/tags/f5-networks.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [firewalls](<https://devfeed.tech/tags/firewalls.md>), [hot-stuff](<https://devfeed.tech/tags/hot-stuff.md>), [msp](<https://devfeed.tech/tags/msp.md>), [news](<https://devfeed.tech/tags/news.md>), [patches](<https://devfeed.tech/tags/patches.md>), [path-traversal](<https://devfeed.tech/tags/path-traversal.md>), [rce](<https://devfeed.tech/tags/rce.md>), [remote-code-execution](<https://devfeed.tech/tags/remote-code-execution.md>), [security-advisory](<https://devfeed.tech/tags/security-advisory.md>), [smbs](<https://devfeed.tech/tags/smbs.md>), [vpn](<https://devfeed.tech/tags/vpn.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Help Net Security reports that attackers exploited a critical Check Point Management Server vulnerability and began probing a separate authentication-bypass and remote-code-execution flaw affecting Check Point Spark firewalls. The article describes emergency fixes, mitigations, and indicators of compromise, and mentions attacks targeting F5 BIG-IP APM instances.

## Source excerpt

Check Point Software has released emergency fixes for a critical Check Point Management Server vulnerability (CVE-2026-93616) that has been exploited as far back as July 23, 2026. The company also confirmed that a pre-authentication remote code execution (RCE) vulnerability (CVE-2026-85102) in Check Point (Quantum) Security Gateway for which it released patches on September 9, 2026, started getting probed a few days after. "At the time [of the release of the patches], we had no evidence ... More -> The post Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances appeared first on Help Net Security.