CVE-2026-20732

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-451

Affected software

Vendor	Product	Versions
F5	BIG-IP	>= 17.5.0, < 17.5.1.4; >= 17.1.0, < 17.1.3.1; >= 16.1.0, < *

References

https://my.f5.com/manage/s/article/K000156644Vendor Advisory

Timeline

Published: Feb 4, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-207335.3Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-207345.6Improper initialization in some firmware for some Intel(R) Active Management Technology (Intel(R) AMT), and some Intel(R) Standard Manageabi CVE-2026-207367.5Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository ma CVE-2026-207377.9Exposure of sensitive information to an unauthorized actor for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device CVE-2026-207388.5Untrusted pointer dereference for some Intel(R) QuickAssist Adapter 8960 software before version 1.13 within Ring 3: User Applications may a CVE-2026-207397.4Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of se CVE-2026-20746.3A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of t CVE-2026-207417.4Improper access control for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. Unprivi CVE-2026-207428.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote c CVE-2026-207449.8The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.CVE-2026-207457.4Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service.CVE-2026-207466.3Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when