IT security 2026-09-22

Level Critical — 94/100 — 2026-09-22

Critical day: 16 stories ranked, 5 of the top 10 reported as actively exploited, 5 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Check Point Multiple Products Path Traversal Vulnerability (86/100).

1. Check Point Multiple Products Path Traversal Vulnerability — 86/100 (CVE-2026-93616)
2. F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability — 84/100 (CVE-2026-94127)
3. Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability — 67/100 (CVE-2026-7273)
4. Check Point Multiple Products Improper Certificate Validation Vulnerability — 67/100 (CVE-2026-85102)
5. Arista VeloCloud Orchestrator Improper Input Validation Vulnerability — 66/100 (CVE-2026-93952)
6. CVE-2026-83660 — Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could res… — 39/100 (CVE-2026-83660)
7. CVE-2026-82443 — Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could res… — 38/100 (CVE-2026-82443)
8. CVE-2026-89276 — Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vuln… — 38/100 (CVE-2026-89276)
9. CVE-2026-17618 — IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to… — 38/100 (CVE-2026-17618)
10. CVE-2026-28324 — SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vul… — 38/100 (CVE-2026-28324)