CVE-2026-20730

Published: Feb 4, 2026Modified: Jun 17, 2026

2.0

Vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: f5sirt@f5.com (Secondary)

Description

A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected (5)

Products: F5: Big Ip Access Policy Manager, Big Ip Access Policy Manager Client

2 products

Big Ip Access Policy Manager

Big Ip Access Policy Manager Client

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Access Policy Manager	From 16.1.0 to 16.1.6
F5 Big Ip Access Policy Manager	From 17.1.0 to 17.1.3.1
F5 Big Ip Access Policy Manager	Version 17.5.0
F5 Big Ip Access Policy Manager	Version 17.5.1
F5 Big Ip Access Policy Manager Client	From 7.2.5 to 7.2.6.2

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (1)

https://my.f5.com/manage/s/article/K000158931

Source: f5sirt@f5.com

Vendor Advisory

Timeline

No history available yet.