Low severity3.1NVD Advisory· Published Feb 4, 2026· Updated Jun 17, 2026

CVE-2026-20732

Description

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

F5, Inc./Big IPcpe-rescue
Range: 17.5.0

Patches

Vulnerability mechanics

References

my.f5.com/manage/s/article/K000156644nvdVendor Advisory

News mentions

No linked articles in our index yet.

Severity

LowCVSS v3.1

3.1/ 10

CVSS v42.3

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: High
Privileges: None
User interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

Probability of exploitation in the next 30 days.

0.15%

VYPR risk score

Composite of severity, exploitation, and reach.

0.20low

cvss	0.202
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-451
User Interface (UI) Misrepresentation of Critical Information

CVE ID

CVE-2026-20732

Credits

FA
F5 acknowledges Michał Majchrowicz, Marcin Wyczechowski, and Zbigniew Piotrak (members of the AFINE Team) for bringing this issue to our attention and following the highest standards of coordinated disclosure.
finder