If you manage Check Point firewalls for clients, two separate Check Point bugs are being exploited, and one of them is in the product line Check Point sells to small businesses and MSPs. CISA added both to KEV on September 22 with a due date of September 25.

The first, CVE-2026-85102, is in the gateway. Check Point's advisory calls it "a pre-authentication remote code execution vulnerability in Security Gateway's VPN certificate handling." The fix shipped on September 9, and "At the time, we had no evidence of exploitation." That changed three days later: "Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers." Help Net Security describes Spark as "a line of next-generation firewalls aimed at small and medium-sized businesses and managed service providers." Security Gateway is affected too, as are both locally and centrally managed Spark. Per sk1000117, exposure depends on certificate authentication: every certificate-authenticated Remote Access VPN configuration is affected, and so is Site-to-Site VPN that uses certificates. Site-to-Site tunnels that use only pre-shared keys are exempt.

The second, CVE-2026-93616, is in the management server, and it was a zero-day. Check Point says "we observed a handful of pinpointed attacks on July 23, 2026" — two months before a fix existed. It is a "pre-authentication path traversal vulnerability in the Check Point Management web service." sk1000171 lists Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent as affected, and states that "Check Point is aware of a handful of customers who have been attacked." Both bugs carry a CVSS score of 9.8.

Two details in the management fix are easy to miss. First, a recently patched server may still be exposed: "Check Point LivePatch Take 28/29 does not address this issue." The fix is in the Jumbo Hotfix Accumulator starting from Take 45 on R82.10, Take 127 on R82, Take 170 on R81.20 and Take 192 on R81.10, with a separate Security Hotfix for R82.20. Check Point says no LivePatch will be offered for this one. Second, patching tells you nothing about July. As The Hacker News puts it, "Installing the fix does not show whether the server was attacked before."

Check Point supplies the hunting steps. For the gateway bug, it says "Review your logs for anomalous certificate-based Mobile Access logins. Do not limit the search to the subjects above." The subjects it has seen so far include CN=vpn,OU=users,O=global, and follow-up activity "often involves internal port and service scan." For the management bug, sk1000171 gives two Expert-mode greps against $MDS_FWDIR/log/cpm.elg*: one for login requests carrying an oversized username, and one for Failed to load allResourceFiles map from errors whose paths contain ../ sequences.

If you cannot patch a management server today, restrict it. Check Point's instruction is to "Make sure that access to port TCP/19009 is only possible from Trusted IP addresses." The gateway workaround — turning off the implied VPN rules and allowing UDP ports 500 and 4500 only from specific peer IP addresses — has a gap that matters for MSP fleets: The Hacker News notes that "The workaround does not apply to locally managed Spark firewalls." Those need the fix.

Action this week: list every Check Point gateway, Spark appliance, management server, log server and SmartEvent box across your clients. Put the certificate-VPN gateways and locally managed Spark units first, and confirm each carries the sk1000117 fix. Move management and log servers to the takes above, not a LivePatch. Run both cpm.elg greps and the Mobile Access login review on every server regardless of patch state, because the management attacks predate the fix by two months.

Advisories

Cisco ISE: a CVSS 10.0 authentication bypass, exploited, and already past its KEV date

CISA added CVE-2026-76460 on September 16 with a due date of September 19. Cisco's advisory says it "could allow an unauthenticated, remote attacker to bypass authentication" on ISE and ISE-PIC "regardless of device configuration," and that "The Cisco PSIRT is aware of active exploitation." Cisco scores it 10.0, and warns that attackers "may obtain command execution with root privileges" and can hide their tracks.

Action: upgrade to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4. Review access.log for suspicious usernames on every node; if you find any, Cisco says "it is strongly recommended to re-image the affected nodes."

F5 BIG-IP APM and Arista VeloCloud land in the same KEV batch

CISA added two more exploited edge bugs alongside Check Point on September 22. F5's CVE-2026-94127 is unauthenticated remote code execution scored 9.8, but "This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server." Arista's CVE-2026-93952 hits on-prem VeloCloud Orchestrator, scored 10.0, and Arista's advisory says it "is known to be actively exploited." Hosted VCO is already patched.

Action: check APM for OAuth authorization server profiles; KEV says to "apply the vendor-provided iRule" as a stopgap before the patch. For on-prem VCO, the fixed builds are 5.2.3.16 and 6.4.2.8; Arista's fixed-version list does not cover the 6.1.x or 7.0.x trains. Until you are on a fixed build, restrict the web interface to administrative networks.

Chrome 154 ships with 108 security fixes

Google promoted Chrome 154 to stable on September 22 as 154.0.8037.57/.58 for Windows and Mac. "This update includes 108 security fixes," and 11 of them are rated Critical, including CVE-2026-95350 (buffer overflow in ANGLE) and CVE-2026-95339 (use after free in ServiceWorker). Google does not report any as exploited. Extended Stable moved to 152.0.7977.140 the same day. Separately, the KEV deadline for Chromium V8 bug CVE-2026-87491 is today.

Action: Chrome applies updates on relaunch, so force a restart window rather than trusting the version your dashboard reports. Edge takes the same Chromium fixes on its own schedule — check both.

The rest of this week's KEV additions

KEV took 11 additions in the week, and the catalog is at 1,721 entries. Beyond the edge devices above, two are worth an MSP's attention. Zyxel's CVE-2026-7273 lets a "LAN-based, unauthenticated attacker" run commands on GS1900 switches; the advisory lists patched firmware per model, such as 2.90(AAHL.2)C0 for the GS1900-24. Acronis CVE-2026-87886 affects its Backup plugins for hosting panels, fixed in build 1.9.3.1021 for cPanel & WHM and 1.8.11.638 for Plesk. Three Linux kernel bugs make up the rest.

Action: if clients run GS1900 switches, pull their firmware versions from your switch inventory and compare them against Zyxel's table. The KEV due date is tomorrow.

Field notes

Microsoft disrupts EvilTokens, the device-code phishing kit behind 12,000 compromised inboxes

Microsoft Threat Intelligence reports that EvilTokens campaigns "compromised more than 12,000 inboxes in over 10,000 organizations worldwide," and that its Digital Crimes Unit helped disrupt the service's infrastructure. The kit abuses the OAuth device code flow: the victim types an attacker-supplied code into a genuine Microsoft sign-in page, which authorizes the attacker's session and gets around traditional MFA. Microsoft's guidance is direct: "Microsoft recommends blocking device code flow wherever possible."

Action: add a Conditional Access policy in each tenant that blocks the device code flow. If a client uses Teams devices that need it, Microsoft says to "scope the exception to specific Teams device resource accounts." For a confirmed compromise, revoking sessions is not enough. Microsoft notes access tokens can stay active "for up to an hour," so disable the account first.

Product changes

Intune can now stage app and policy rollouts in rings

Intune's what's new for the week of September 21 adds deployment plans: you can "stage a rollout across multiple rings, control rollout timing, and integrate with Multiple Admin Approval." They cover Win32 and Enterprise app catalog apps, plus Settings catalog and Endpoint security policies. The week before, Windows compliance moved to client-driven evaluation, so devices "proactively request reevaluation rather than waiting for a scheduled check-in."

Action: use deployment plans for the next Endpoint security policy change you push across a client. A first ring of IT-owned devices catches a bad baseline before it reaches everyone.

Teams adds per-meeting Conditional Access and an editable blocked-file list

Two Teams security controls appeared on the roadmap this week, both listed for general availability in November. Granular Conditional Access lets administrators "apply Conditional Access policies to selected meetings, helping ensure participants meet organizational security requirements before joining." Separately, Weaponizable File Protection gets admin controls: administrators "will be able to customize which file types are blocked in Teams," or keep "the Microsoft-recommended default list."

Action: for clients with board or HR meetings that carry sensitive material, note the per-meeting Conditional Access feature for November. When the file-type control arrives, start from Microsoft's default list and add only the extensions a client can justify.

Licensing

Copilot Business bought through CSP defaults to pay-as-you-go on November 2

Microsoft told partners on September 16 that "Starting November 2, 2026, new Microsoft 365 Copilot Business licenses that you purchase through Cloud Solution Provider (CSP) include usage-based billing by default." The announcement says new licenses "include the Azure subscription setup needed for usage-based billing," and it points partners at a "preset monthly limit" without stating the amount.

Action: before November 2, decide with each client who buys Copilot Business whether usage-based billing should be on at all. Find the monthly limit in the tenant rather than assuming it, because the charges run through an Azure subscription rather than the license line you already reconcile.

Compliance

Legacy Teams retention policies will stop covering Copilot interactions

A Purview roadmap item posted September 18 says "Some existing retention policies scoped to Microsoft Teams may currently also apply to Microsoft 365 Copilot interactions." Those policies "will be converted to—and treated as—Teams-only policies. They will no longer implicitly govern Copilot workloads." General availability is listed for October.

Action: if a client's retention obligations cover Copilot prompts and responses, check whether an explicit Copilot retention policy exists. If the only coverage is a legacy Teams policy, create the Copilot policy before October.