CVE-2026-66842

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI). Impact: This vulnerability may allow an authenticated attacker with network access to the BIG-IP management interface to escalate privileges by creating administrative accounts on the BIG-IP system. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Score

CVSS 3.1 8.8 High

Status

Awaiting Analysis - f5sirt@f5.com

Published

2026-09-02

Last modified

2026-09-03

Weaknesses

CWE-918

Affected products

• Big-ip (F5)
• Big-iq (F5)

References

• https://my.f5.com/manage/s/article/K000162521