CVE-2026-66842

HighCVSS 8.8/10Last modified Sep 3, 2026

Description

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI).

Impact:

This vulnerability may allow an authenticated attacker with network access to the BIG-IP management interface to escalate privileges by creating administrative accounts on the BIG-IP system. There is no data plane exposure; this is a control plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Sep 3, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-668436.1Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote atta CVE-2026-668494.3Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted a CVE-2026-668534.3Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visi CVE-2026-668588.7The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fie CVE-2026-668598.7NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift:CVE-2026-66864.6FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly alloca CVE-2026-66877.6FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcin CVE-2026-668746.5For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow bran CVE-2026-668758.8In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–3 CVE-2026-668778.1Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's a CVE-2026-668787.7A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel CVE-2026-66887.6FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, f