F5 and Arista ship fixes for actively exploited zero-day flaws

Admins of BIG-IP APM and VeloCloud Orchestrator must move quickly as both zero-days are under active attack and already flagged by CISA.

F5 and Arista have both shipped patches for critical zero-day vulnerabilities in widely deployed network access and SD-WAN management products that are already under active exploitation. F5 fixed a remote code execution bug in BIG-IP APM when an access policy and OAuth profile are configured on a virtual server, and is providing an iRule-based mitigation for customers that cannot patch immediately. CISA added F5’s CVE-2026-94127 to its Known Exploited Vulnerabilities catalog and ordered U.S. federal agencies to remediate it by Friday, underscoring the urgency for any operator running BIG-IP APM. Arista addressed CVE-2026-93952, an improper input validation flaw in on-prem VeloCloud Orchestrator allowing unauthenticated attackers with network access and a public edge certificate to reach privileged internal functionality, and has already updated hosted VCO instances on specific 5.2.x and 6.4.x versions. CISA likewise added Arista’s CVE-2026-93952 to the KEV catalog and U.S. agencies must fix it by Friday, while Arista is telling admins to restrict VCO web access, hunt for suspicious log patterns and outbound traffic, and block two specific IPs linked to ongoing exploitation.