Vulnerability · Published Sep 2, 2026 · Assigned by f5

CVE-2026-66842BIG-IP and BIG-IQ Configuration utility vulnerability

High 8.8

In plain English

A high-severity server-side request forgery in BIG-IP from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 59.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI). Impact: This vulnerability may allow an authenticated attacker with network access to the BIG-IP management interface to escalate privileges by creating administrative accounts on the BIG-IP system. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products (as reported)

Vendor	Product	Versions
F5	BIG-IP	21.1.0 – before 21.1.0.121.0.0 – before 21.0.0.317.5.0 – before 17.5.1.817.1.0 – before 17.1.3.4
F5	BIG-IQ	8.4.0 – before 8.4.2.1

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://my.f5.com/manage/s/article/K000162521 vendor-advisory