{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20732", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "state": "PUBLISHED", "assignerShortName": "f5", "dateReserved": "2026-01-21T21:33:16.381Z", "datePublished": "2026-02-04T15:02:05.281Z", "dateUpdated": "2026-02-04T16:08:05.470Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["All Modules"], "product": "BIG-IP", "vendor": "F5", "versions": [{"lessThan": "*", "status": "unaffected", "version": "21.0.0", "versionType": "custom"}, {"lessThan": "17.5.1.4", "status": "affected", "version": "17.5.0", "versionType": "custom"}, {"lessThan": "17.1.3.1", "status": "affected", "version": "17.1.0", "versionType": "custom"}, {"lessThan": "*", "status": "affected", "version": "16.1.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "F5 acknowledges Micha\u0142 Majchrowicz, Marcin Wyczechowski, and Zbigniew Piotrak (members of the AFINE Team) for bringing this issue to our attention and following the highest standards of coordinated disclosure."}], "datePublic": "2026-02-04T15:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages.&nbsp;&nbsp;</span>Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "value": "A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 2.3, "baseSeverity": "LOW", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-451", "description": "CWE-451: User Interface (UI) Misrepresentation of Critical Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2026-02-04T15:02:05.281Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://my.f5.com/manage/s/article/K000156644"}], "source": {"discovery": "EXTERNAL"}, "title": "BIG-IP Configuration utility vulnerability", "x_generator": {"engine": "F5 SIRTBot v1.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T16:07:17.980958Z", "id": "CVE-2026-20732", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:08:05.470Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20732", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T16:07:17.980958Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:07:56.927Z"}}], "cna": {"title": "BIG-IP Configuration utility vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "F5 acknowledges Micha\u0142 Majchrowicz, Marcin Wyczechowski, and Zbigniew Piotrak (members of the AFINE Team) for bringing this issue to our attention and following the highest standards of coordinated disclosure."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "F5", "modules": ["All Modules"], "product": "BIG-IP", "versions": [{"status": "unaffected", "version": "21.0.0", "lessThan": "*", "versionType": "custom"}, {"status": "affected", "version": "17.5.0", "lessThan": "17.5.1.4", "versionType": "custom"}, {"status": "affected", "version": "17.1.0", "lessThan": "17.1.3.1", "versionType": "custom"}, {"status": "affected", "version": "16.1.0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "datePublic": "2026-02-04T15:00:00.000Z", "references": [{"url": "https://my.f5.com/manage/s/article/K000156644", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "F5 SIRTBot v1.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages.&nbsp;&nbsp;</span>Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-451", "description": "CWE-451: User Interface (UI) Misrepresentation of Critical Information"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2026-02-04T15:02:05.281Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20732", "state": "PUBLISHED", "dateUpdated": "2026-02-04T16:08:05.470Z", "dateReserved": "2026-01-21T21:33:16.381Z", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "datePublished": "2026-02-04T15:02:05.281Z", "assignerShortName": "f5"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD3A2286-B181-47DA-BCB3-A9D0E0B357AC", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "004CBB88-E617-4A0A-BE42-E1E6BB52D736", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*", "matchCriteriaId": "920FA89D-E154-4936-B88E-8B60D5B39B40", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "94ADD021-8229-4CDE-AE73-33FB1BD4A3C5", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "216A1ED3-D0CD-4A08-B9E8-A5B54942E831", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA7B9727-7694-4D1B-8B48-175196544050", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*", "matchCriteriaId": "5481F477-166F-4321-80A0-539095C6B829", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*", "matchCriteriaId": "5462B02C-4414-4B14-A671-D8993BD9511D", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A6B33EA-BD41-45A1-801F-BF2439E4F501", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*", "matchCriteriaId": "972BEB00-AAC3-42F7-BB45-881E1A3D1131", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*", "matchCriteriaId": "226B7285-7977-4BBC-947E-E9541E1AAB89", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B49FF41-861D-488F-94DC-DAE222A9BE0D", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "4962EDD5-384F-4ABC-8696-8C4AACEE19BD", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE7A5976-AAA0-4FF1-ADAC-4547F24765FA", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "5728B748-0795-4056-91E8-B3A0DB3A3081", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "C453B7CE-FBA6-46E7-975D-61D7A18773F9", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "EC77DFC2-A3DC-46E6-9419-0ABA84CD275E", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "25701935-02F5-4BD8-95F0-6693C6606558", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC71E265-C7B7-4A78-B73A-32B5FECE5D36", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B029869-31AB-4FE2-846E-FC6F7133ADF8", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*", "matchCriteriaId": "2760AEE2-DCA4-4ED8-92DE-F409EED1A7D9", "versionEndIncluding": "16.1.6", "versionStartIncluding": "16.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "8AA506C6-269A-414F-8D9A-B14BB7557308", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "572D9204-F862-4D58-81F5-025EBC63C47F", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "06C03575-5FDA-45B9-B294-9994C083DFEA", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "A31FB687-E5D0-4895-9144-A56F5DD62762", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*", "matchCriteriaId": "B248CFD1-7095-4E6F-A72A-23AA9C1A4615", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*", "matchCriteriaId": "1A1E893E-2524-48FF-84B4-3BF607D30B51", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B2FBE19-2AE9-42E4-9F92-FA7436DB3ECE", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "AF3ABBAB-A921-419F-A0F6-2E0A134A3F20", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "8D03E914-1383-4950-BC80-811F3CDF2DF2", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "0CB6BCD4-9FCF-4D87-8F96-44197B2DA34D", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "4FC4FD92-F496-46C7-A896-3C8F53F2D86A", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "BDEC2620-4C8A-4BBF-9DC9-8FE4BDB79068", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E29086A-10D0-4C7F-AA61-4507AED2B7BD", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*", "matchCriteriaId": "0756AA83-2271-475C-BE33-5DCDF49B6C8D", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*", "matchCriteriaId": "72DBD6A8-D66E-413C-B0A8-03BB4A36EFF1", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*", "matchCriteriaId": "6E9FECC2-B252-4324-8BA6-889FE3B19E74", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*", "matchCriteriaId": "342FB182-C969-4C10-B19A-B759DAD1A7DA", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*", "matchCriteriaId": "390FCDB9-FEBB-4D6F-B54B-BE2FC5E3A376", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*", "matchCriteriaId": "8606D37A-CA80-4D7B-880C-ADD39D2FE540", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*", "matchCriteriaId": "6C086154-AA26-4EEE-983A-3320B6F6F4F3", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*", "matchCriteriaId": "99B99D8B-A1CB-45B6-B9A2-E0414807A1B7", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*", "matchCriteriaId": "8AE0F043-6356-426E-AA39-ABAFF736ECE3", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "100CEE47-7F09-48AF-A3BD-734E6E987790", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "3D89B768-239D-4102-A5EA-8723019A4845", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "743BE992-18D6-4C09-81FA-9EB497373D2B", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "117BA660-28EE-4C98-BE9F-23A321620B38", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", "matchCriteriaId": "985D71E2-BBD4-4779-AB50-399BC40186B0", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D9CA9C1-B6D9-490F-82ED-0ECBC09C6A40", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "22EE0EEB-C4B7-4C93-B65F-0219098B75D6", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "39D1486B-F0D4-4D4C-A11B-E3E1E6F30162", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "2736B84F-D892-4602-8BE7-4329E36E3BB5", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "44BA40A5-F1F9-416A-AF7A-7624A2620B4F", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0.", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "C92E57FE-57F4-4FF5-A89C-FE4BDB804060", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "83C8F4D3-FE1E-4BDC-AD32-BC570F325022", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "A93E9509-2B18-49D1-9B78-CC49EACFA930", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "58006023-CFF1-41B3-9961-6D2728E45FE1", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "68C52EBC-167C-4D46-93E1-0302860D42CD", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "27838D60-7CB2-464A-85CD-9F2BF94DED28", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*", "matchCriteriaId": "0CCD0DDB-D6EA-47D1-9E90-90D194B981E7", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*", "matchCriteriaId": "D83813AD-9401-43F1-9C9A-A52F3334C05F", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*", "matchCriteriaId": "8229B10B-0902-4FAC-B31D-8DB9E0A3F348", "versionEndExcluding": "17.1.3.1", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*", "matchCriteriaId": "95965E49-EC7F-4CBE-9E1C-B0A8E3057329", "versionEndExcluding": "17.5.1.4", "versionStartIncluding": "17.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "id": "CVE-2026-20732", "lastModified": "2026-02-13T21:44:33.627", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "f5sirt@f5.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f5sirt@f5.com", "type": "Secondary"}]}, "published": "2026-02-04T15:16:14.740", "references": [{"source": "f5sirt@f5.com", "tags": ["Vendor Advisory"], "url": "https://my.f5.com/manage/s/article/K000156644"}], "sourceIdentifier": "f5sirt@f5.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-451"}], "source": "f5sirt@f5.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T23:50:25.278376+00:00", "value": {"mitigation_remediation": ["Apply any vendor\u2011supplied patch or update to a BIG\u2011IP version that eliminates the vulnerable configuration utility page.", "If a patch is unavailable, restrict access to the configuration utility to trusted administrators only and enforce strict role\u2011based access controls.", "Monitor configuration and error logs for unexpected or repeated error messages that could indicate spoofing attempts, and investigate anomalies promptly."], "summary": {"action": "Patch", "impact": "Spoofed error messages that could mislead administrators"}, "threat_synthesis": {"affected_systems": "All F5 BIG\u2011IP products that incorporate the exposed configuration utility page, including Advanced Web Application Firewall, Application Acceleration Manager, Analytics, and other listed variants, are potentially affected. No specific version ranges are provided, so all current releases should be reviewed for the presence of the vulnerable page.", "description_and_impact": "The vulnerability resides in an undisclosed configuration utility page of F5 BIG\u2011IP, allowing an attacker to fabricate error messages. This flaw, classified as CWE\u2011451, could cause administrators to be misled or to trust incorrect system states, potentially leading to incorrect troubleshooting or authorization decisions. The official description does not indicate that confidentiality, integrity, or availability are directly compromised, so the impact is limited to deceptive authentication of error states.", "risk_and_exploitability": "The CVSS score reflects a low\u2011severity weakness; the EPSS probability is below 1\u202f% and the flaw is not listed in the CISA KEV catalog. The likely attack vector is remote, via the web\u2011based configuration interface, and the attacker would need administrative or privileged credentials to reach the vulnerable page. Because the flaw only allows message spoofing, the overall risk is low, but it introduces a subtle avenue for deception that can be exploited in targeted environments."}}}}, "created": "2026-02-04T21:17:56.256604+00:00", "updated": "2026-04-18T00:00:09.473176+00:00", "vendors": ["f5", "f5$PRODUCT$big-ip"]}