eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
BIG-IP APM Zero-Day Vulnerability Disclosed
Bottom Line: F5 has disclosed the existence of a critical zero-day vulnerability, CVE-2026-94127, in the BIG-IP Access Policy Manager product. Proof-of-Concept exploit code was released shortly after, increasing the likelihood of widespread exploitation by multiple threat actors.
On September 22nd, 2026, F5 disclosed a critical zero-day vulnerability impacting its BIG-IP Access Policy Manager (APM) software. CVE-2026-94127 (CVSS: 9.8) is a heap-based buffer overflow flaw within BIG-IP APM when a BIG-IP APM access policy and OAuth profile are configured on a virtual server. Exploitation of the flaw would require an attacker to send specially crafted malicious traffic to the server and can lead to unauthenticated Remote Code Execution (RCE). The vulnerability impacts BIG-IP APM versions 17.1.0 through 17.1.3, 17.5.0 through 17.5.1, and 21.1.0; F5 has released patches to address CVE-2026-94127. Within the advisory, F5 states that in-the-wild exploitation of CVE-2026-94127 has been observed.
On September 23rd, watchTowr Labs published a report and further technical details on CVE-2026-94127, which they uncovered through patch diffing. The root cause of the vulnerability was determined to be missing bounds checks within the OAuth Authorization headers, resulting in buffer overflow and leading to a possible RCE exploit chain. Proof-of-Concept (PoC) exploit code was also published by watchTowr Labs to demonstrate the exploit and generate detection artifacts.
eSentire Threat Intelligence Analysis:
F5 states that exploitation of CVE-2026-94127 has been observed in the wild but provide no additional information or context around the reported attacks. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on September 22nd, giving Federal Civilian Executive Branch (FCEB) agencies a deadline of September 25th to apply patches. Within their research, watchTowr Labs demonstrated that the root cause of the vulnerability was easy to uncover through patch diffing. With the technical report and publicly available PoC released by watchTowr Labs, it is likely that threat actors will be able to weaponize it, or develop their own exploits, to conduct more widespread attacks. Given that BIG-IP APM is an access management solution that sits at the network edge, exploitation has been observed and does not require authentication, and the public availability of PoC, eSentire's Threat Intelligence team assesses with high confidence that widespread exploitation of CVE-2026-94127 will be seen in the near term.
Organizations that utilize BIG-IP APM within their environment should ensure that the released patches are applied immediately. As CVE-2026-94127 impacts the BIG-IP data plane, which handles network traffic flow, F5 has created an iRule which can be used to temporarily mitigate risk until relevant patches can be applied; as per the advisory, organizations must contact F5 Support to receive the relevant iRule. eSentire published an advisory for CVE-2026-94127 on September 23rd, and eSentire's Threat Response Unit (TRU) is continuing to track this topic for additional information and detection opportunities.
Check Point Management Server Zero-Day and Gateway RCE Under Active Exploitation
Bottom Line: Check Point disclosed one critical vulnerability and updated a second (CVE-2026-93616 and CVE-2026-85102) impacting its Security Gateway and Security Management products. Because exploitation has been confirmed, organizations should apply relevant patches.
On September 22nd, 2026, Check Point published a security advisory disclosing active exploitation of two critical, pre-authentication vulnerabilities affecting its Security Gateway and Security Management product lines. CVE-2026-85102 (CVSS 9.8) is a pre-authentication remote code execution vulnerability caused by improper validation of certificate data during VPN negotiation, affecting Security Gateway and both centrally and locally managed Spark Firewall products. Check Point disclosed and patched this flaw on September 9th with no evidence of exploitation at that time, but began observing a wave of exploitation attempts against Spark customers globally starting September 12th, originating from anonymization infrastructure (VPN services and proxies) and using certificates with generic subjects.
CVE-2026-93616 (CVSS 9.8) is a separately disclosed zero-day, a pre-authentication path traversal vulnerability in the Check Point Management web service that allows an attacker to execute a script from an arbitrary path and load an arbitrary Java class, affecting Security Management, Multi-Domain Security Management, Log Server, and SmartEvent. Check Point confirmed a handful of pinpointed, targeted exploitation attempts, with the earliest observed activity dating back to July 23rd, 2026, nearly two months before public disclosure. A fix was released concurrently with the September 22nd advisory. Check Point noted that standard LivePatch updates (Take 28/29) do not address this vulnerability; the specific Jumbo Hotfix or Security Hotfix detailed in support article sk1000171 must be applied separately.
CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog on September 22nd, giving Federal Civilian Executive Branch agencies a compressed remediation deadline of September 25th, 2026.
eSentire Threat Intelligence Analysis:
Successful exploitation of either vulnerability could allow threat actors to gain complete control over affected security infrastructure. Since these products frequently serve as perimeter security controls and centralized management platforms, compromise could provide attackers with privileged access to enterprise environments, facilitate lateral movement, enable credential theft, and allow manipulation or bypass of security controls. The inclusion of both vulnerabilities in the KEV catalog underscores the urgency for organizations to prioritize remediation efforts immediately.
At the time of reporting, no public Proof-of-Concept (PoC) exploit code has been identified for either vulnerability. However, the absence of publicly available exploit code should not be interpreted as a reduced threat. The nearly two-month gap between Check Point’s earliest confirmed exploitation of CVE-2026-93616 (July 23rd) and its public disclosure (September 22nd) is a significant detail.
Organizations operating affected Check Point products should immediately verify whether their systems are running vulnerable versions and apply the relevant security fixes. For CVE-2026-93616, organizations should note that standard LivePatch updates do not remediate the vulnerability and that the specific Jumbo Hotfix or Security Hotfix identified by Check Point must be installed. In addition to patching, security teams should review VPN authentication logs for anomalous certificate-based authentication attempts, investigate suspicious user activity following VPN access, monitor for internal reconnaissance activity, and conduct threat hunting activities focused on unauthorized script execution and abnormal management server behavior. In response to the disclosure and confirmed exploitation of CVE-2026-85102 and CVE-2026-93616, eSentire's Threat Response Unit (TRU) published a security advisory on September 23rd, 2026. The team is actively tracking this topic for additional details and detection opportunities.
Microsoft Disrupts EvilTokens PhaaS Platform
Bottom Line: Microsoft, along with industry partners, announced the disruption of the EvilTokens Phishing-as-a-Service (PhaaS) platform, which uses Device Code Authentication phishing and AI automation to perform Business Email Compromise (BEC) operations.
On September 22nd, 2026, Microsoft disclosed that its Digital Crimes Unit (DCU), together with industry partners, disrupted EvilTokens, a Phishing-as-a-Service (PhaaS) platform that had been active since February 2026. The kit was sold by its operator, Storm-2992, through Telegram channels for an initial fee of $1,500 plus a $500 monthly subscription, with Telegram bots handling customer support, service announcements, and affiliate coordination.
EvilTokens centered on abuse of the OAuth device code authentication flow, a legitimate mechanism designed for input-constrained devices. Victims received phishing emails using various lure themes, including fake invoices and requests for proposals, which linked to a page running a background automation script. That script requested a live device code from Microsoft’s identity provider in real time and displayed it alongside a “Continue with Microsoft” button pointing to the legitimate Microsoft device login portal, while detecting when the victim completed authentication within the 15-minute validity window. Because the authenticating device is not bound to the victim’s original browsing context, a victim who entered the code on the real Microsoft sign-in page unknowingly authenticated the attacker’s session, bypassing Multi-Factor Authentication (MFA) protections. EvilToken subscribers could use an integrated AI-powered assistant to automatically review inbox contents, filter for high-value targets, and draft impersonation emails. Additionally, automation performed Microsoft Graph reconnaissance to map organizational structure and permissions, scan inboxes for keywords tied to wire transfers and establish persistence through malicious inbox rules and abuse of Primary Refresh Tokens (PRTs) via fraudulent device registration.
Microsoft assessed that EvilTokens compromised more than 12,000 inboxes across over 10,000 organizations worldwide, concentrated in the United States, Canada, the United Kingdom, Australia, India, and France. The most impacted industries include wholesale distribution, construction, financial services, real estate, higher education, and healthcare. To disrupt the platform, Microsoft filed a civil action resulting in the seizure of 50 websites and disabling more than 150 additional domains supporting EvilTokens’ operations. Separately, London’s Metropolitan Police cybercrime team arrested two individuals on suspicion of operating EvilTokens.
eSentire Threat Intelligence Analysis:
EvilTokens is a notable example of how cybercriminals are adopting AI into their tooling, enabling broader, faster, and more in-depth compromise victim environments. When AI tool is combined with PhaaS or Malware-as-a-Service (MaaS) operations, it lowers the barriers of entry for less skilled threat actors to adopt sophisticated tooling. In the case of EvilTokens, the use of AI allowed attackers to analyze the contents of compromised inboxes and identify fraud opportunities in minutes rather than days, limiting the time defenders have to remediate the compromise before secondary actions occur.
The disruption of EvilTokens will have an immediate effect on the cybercrime ecosystem, disrupting multiple ongoing campaigns and preventing access for new criminal customers. In the long term, it is possible that Storm-2992 could attempt to rebuild operations and re-establish trust with buyers. Following the March 2026 takedown of the Tycoon 2FA PhaaS platform, which eSentire had traced to 32% of all identity-compromise security incidents across its customer base in 2025, the kit resumed operations shortly afterward. The operators pivoted to new infrastructure rather than shutting down. No arrests were reported in connection with the Tycoon 2FA disruption, unlike EvilTokens, which may make full recovery more difficult for Storm-2992’s operation, even if the underlying code and customer base survive.
eSentire's Threat Response Unit (TRU) continues to track multiple PhaaS operations and maintains a variety of detections for related activity.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
