---
id: "CVE-2020-5902"
kind: "vulnerability"
aliases: ["CVE-2020-5902"]
title: "F5 BIG-IP: F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.99999
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "F5 BIG-IP", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "f5-big-ip", "infrastructure", "load-balancer", "ransomware", "self-hosted"]
not_affected_if: ["no-big-ip", "tmui-disabled"]
published_at: "2020-07-01T15:15:15+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-5902", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-5902", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5902", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# F5 BIG-IP: F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

F5 BIG-IP's Traffic Management User Interface (TMUI) has a remote code execution flaw in undisclosed pages. An unauthenticated attacker on the network can run code on the appliance, and CISA reports it is being exploited in the wild, including in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:F5 BIG-IP affected ? fixed ?

## Fix

Apply the F5 vendor updates for BIG-IP per the vendor advisory referenced by CISA (the sources do not list the fixed versions).

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-5902
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-5902
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-5902

## From the sources

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_