Cyber Resilience

CVE-2026-20732

F5 Big-Ip Access Policy Manager 16.1.0 – 16.1.6

Published
04 February 2026
Modified
13 February 2026
Patch / advisory
View advisory
CVSS Score v4 2.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0015 5th percentile
Risk Priority 15 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-20732 is a low-severity User Interface (UI) Misrepresentation of Critical Information (CWE-451) vulnerability in F5 Big-Ip Access Policy Manager. Its CVSS base score is 2.3 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Phishing (T1566); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CWE(s)
CWE-451NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1566 Phishing Initial Access
Adversaries may send phishing messages to gain access to victim systems.
attack.mitre.org →
T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
attack.mitre.org →
T1566.003 Spearphishing via Service Initial Access
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems.
attack.mitre.org →
T1598 Phishing for Information Reconnaissance
Adversaries may send phishing messages to elicit sensitive information that can be used during targeting.
attack.mitre.org →
T1598.003 Spearphishing Link Reconnaissance
Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting.
attack.mitre.org →
T1534 Internal Spearphishing Lateral Movement
After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-40462Same product: F5 Big-Ip Access Policy Manager
CVE-2026-42058Same product: F5 Big-Ip Access Policy Manager
CVE-2026-42919Same product: F5 Big-Ip Access Policy Manager
CVE-2026-42781Same product: F5 Big-Ip Access Policy Manager
CVE-2025-53868Same product: F5 Big-Ip Access Policy Manager
CVE-2025-20058Same product: F5 Big-Ip Access Policy Manager
CVE-2026-35062Same product: F5 Big-Ip Access Policy Manager
CVE-2025-61951Same product: F5 Big-Ip Access Policy Manager
CVE-2026-39455Same product: F5 Big-Ip Access Policy Manager
CVE-2026-40423Same product: F5 Big-Ip Access Policy Manager

Affected Assets

f5
big-ip access policy manager
16.1.0 — 16.1.6 · 17.1.0 — 17.1.3.1 · 17.5.0 — 17.5.1.4
f5
big-ip advanced firewall manager
16.1.0 — 16.1.6 · 17.1.0 — 17.1.3.1 · 17.5.0 — 17.5.1.4
f5
big-ip advanced web application firewall
16.1.0 — 16.1.6 · 17.1.0 — 17.1.3.1 · 17.5.0 — 17.5.1.4
f5
big-ip analytics
16.1.0 — 16.1.6 · 17.1.0 — 17.1.3.1 · 17.5.0 — 17.5.1.4
f5
big-ip application acceleration manager
16.1.0 — 16.1.6 · 17.1.0 — 17.1.3.1 · 17.5.0 — 17.5.1.4
f5
big-ip application security manager
16.1.0 — 16.1.6 · 17.1.0 — 17.1.3.1 · 17.5.0 — 17.5.1.4
f5
big-ip application visibility and reporting
16.1.0 — 16.1.6 · 17.1.0 — 17.1.3.1 · 17.5.0 — 17.5.1.4
f5
big-ip automation toolchain
16.1.0 — 16.1.6 · 17.1.0 — 17.1.3.1 · 17.5.0 — 17.5.1.4
f5
big-ip carrier-grade nat
16.1.0 — 16.1.6 · 17.1.0 — 17.1.3.1 · 17.5.0 — 17.5.1.4
f5
big-ip container ingress services
16.1.0 — 16.1.6 · 17.1.0 — 17.1.3.1 · 17.5.0 — 17.5.1.4
+11 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly address design and implementation of accurate, non-spoofable UI elements.

PR.AT-01 partial match
prevents

User awareness training helps people recognize and avoid harm from UI misrepresentation such as phishing, but does not prevent the flaw itself.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect UI misrepresentation vulnerabilities before deployment.

A.6.3 Information security awareness, education and training partial match
prevents

Security awareness training can teach users to recognize UI misrepresentation and phishing attempts.

A.8.23 Web filtering partial match
mitigates

Web filtering can block known phishing sites that exploit UI misrepresentation.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle includes UI/UX security requirements that can prevent misrepresentation of critical information.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate proper display and validation of critical information in the UI.

A.8.28 Secure coding partial match
prevents

Secure coding practices can prevent UI flaws that obscure or spoof critical information.

References