CVE-2020-5902 RCE in F5 BIG-IP TMUI

CVE-2020-5902 is a remote code execution (RCE) vulnerability in the management interface (TMUI, Traffic Management User Interface) of F5 BIG-IP. The flaw resides in undisclosed pages of the TMUI and is present in versions 11.6.1 through 15.1.0.3. BIG-IP is a critical load balancer and application delivery controller in enterprise and carrier infrastructures; an RCE on this component enables unauthorized remote administrative access to the entire load balancing and traffic management system.

The CVSS score is 9.8, critical category. The CVE was published by the National Vulnerability Database on 2020-07-01, six years ago. However, on 2026-10-31 a public repository on GitHub was detected declaring to contain exploit code for this vulnerability, suggesting a possible re-emergence of interest in threat circles. The officially declared severity is critical.

Administrators managing F5 BIG-IP infrastructure must immediately verify the version in use and compare it with the list of vulnerable versions. F5 has provided patches for this vulnerability, available in the official update catalog. A fundamental defensive practice is to control and limit access to the TMUI (default port 443) to dedicated management networks, disabling public Internet access where possible.