Skip to main content

Big Ip Advanced Web Application Firewall CVE-2026-20732

LOW
User Interface (UI) Misrepresentation of Critical Information (CWE-451)
2026-02-04 f5sirt@f5.com
Information Disclosure Big Ip Advanced Web Application Firewall Big Ip Application Security Manager Big Ip Container Ingress Services Big Ip Access Policy Manager Big Ip Advanced Firewall Manager Big Ip Analytics Big Ip Application Acceleration Manager Big Ip Application Visibility And Reporting Big Ip Automation Toolchain Big Ip Carrier Grade Nat Big Ip Ddos Hybrid Defender Big Ip Domain Name System Big Ip Edge Gateway Big Ip Fraud Protection Service Big Ip Global Traffic Manager Big Ip Link Controller Big Ip Local Traffic Manager Big Ip Policy Enforcement Manager Big Ip Ssl Orchestrator Big Ip Webaccelerator Big Ip Websafe
3.1
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
3.1 LOW
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Feb 04, 2026 - 15:16 nvd
LOW 3.1

DescriptionCVE.org

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Big-Ip Access Policy Manager is affected by user interface (ui) misrepresentation of critical information (CVSS 3.1).

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment CVSS 3.1 (LOW). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker could exploit this vulnerability to spoof error messages.
Remediation Monitor vendor advisories for a patch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

During next maintenance window: Apply vendor patches when convenient. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Big Ip Advanced Web Application Firewall

View all
CVE-2025-20029 HIGH
8.7 Feb 05

F5 BIG-IP contains an authenticated command injection in the iControl REST API and TMOS Shell (tmsh) save command. Authe
CVE-2025-21087 HIGH
8.9 Feb 05

When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclo
CVE-2025-41433 HIGH
8.7 May 07

When a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is conf
CVE-2025-21091 HIGH
8.7 Feb 05

When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilizatio
CVE-2025-36504 HIGH
8.7 May 07

When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase i
CVE-2025-31644 HIGH
8.5 May 07

When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS
CVE-2026-22548 MEDIUM
5.9 Feb 04

BIG-IP Advanced WAF and ASM experience denial of service when processing specific requests under certain conditions, cau
CVE-2025-54500 MEDIUM
6.9 Aug 13

An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to bre
CVE-2025-52585 HIGH
8.7 Aug 13

When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diff
CVE-2025-41414 HIGH
8.7 May 07

When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate
CVE-2025-41399 HIGH
8.7 May 07

When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can c
CVE-2025-24320 MEDIUM
5.1 Feb 05

A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that

Same weakness CWE-451 – User Interface (UI) Misrepresentation of Critical Information

View all
CVE-2025-8043 CRITICAL POC
9.8
CVE-2025-7021 MEDIUM POC
6.5
CVE-2026-0907 CRITICAL
9.8
CVE-2026-0906 CRITICAL
9.8
CVE-2026-2634 CRITICAL
9.8
CVE-2025-68277 MEDIUM POC
5.0
CVE-2026-11175 HIGH
8.8
CVE-2026-11172 HIGH
8.8

Same technique Information Disclosure

View all
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2014-6324 HIGH POC
8.8
CVE-2017-0213 HIGH POC
7.3
CVE-2016-7255 HIGH POC
7.8
CVE-2010-0232 HIGH POC
7.8
CVE-2025-30066 HIGH POC
8.6
CVE-2025-54236 CRITICAL POC
9.1

Share

CVE-2026-20732 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy