IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
8.8Alta

CVE-2026-66842BIG-IP and BIG-IQ Configuration utility vulnerability

F5 BIG-IP; F5 BIG-IQ Publicada: (hace 2 meses)

Descripción

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI). Impact: This vulnerability may allow an authenticated attacker with network access to the BIG-IP management interface to escalate privileges by creating administrative accounts on the BIG-IP system. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Debilidad (CWE): CWE-918

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
F5 BIG-IP 21.1.0 – < 21.1.0.1, 21.0.0 – < 21.0.0.3, 17.5.0 – < 17.5.1.8, 17.1.0 – < 17.1.3.4
F5 BIG-IQ 8.4.0 – < 8.4.2.1

Referencias y parches

CVE recientes del mismo producto — F5 BIG-IP

9.8Crítica
CVE-2026-94127 KEV

BIG-IP APM OAuth vulnerability

F5 BIG-IP

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Dep…

27%EPSS
3.1Baja
CVE-2026-63020

BIG-IP Configuration utility vulnerability

F5 BIG-IP

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages  Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message …

7.5Alta
CVE-2026-59762

BIG-IP HTTP/2 vulnerability

F5 BIG-IP; F5 BIG-IP Next for Kubernetes; F5 BIG-IP Next SPK; F5 BIG-IP Next CNF

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.   Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. …

7.5Alta
CVE-2026-40423

BIG-IP SIP profile vulnerability

F5 BIG-IP

When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.8Media
CVE-2026-24464

Appliance mode iControl REST vulnerability

F5 BIG-IP

When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cross a security boundary and delete files.  Note: Software vers…

7.5Alta
CVE-2026-39458

BIG-IP DNS Cache vulnerability

F5 BIG-IP

When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have …